Source code
Security & compliance
Mass assignment: request body written wholesale into a model
Part of the Route authorization check · fix arrives as a pull request
What it is
A request body is passed wholesale into a model create or update — a spread of req.body, or an ORM call taking the parsed body directly.
Why it matters
The user can set any column the model exposes, including ones no form shows: role, is_admin, tenant_id, credits. Privilege escalation becomes a matter of adding a field to the JSON.
How to fix it
Accept an explicit allow-list of fields, built by picking them out rather than by removing the dangerous ones — a deny-list goes stale the moment a column is added. A schema validator with a strict shape does this at the boundary.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.