mass-assignment-anti-pattern

Mass assignment vulnerability is an insecure pattern where user-supplied data directly updates sensitive object properties, allowing unauthorized modification. This Skill detects such injection risks by identifying insecure direct object updates from user input in Python and JavaScript codebases.

To detect CWE-915 insecure direct object updates, analyze your code for patterns where incoming user input is directly mapped to application models. This Skill performs explicit code analysis to identify these vulnerabilities and flags insecure property binding during object creation or updates.

The best way to prevent mass assignment vulnerabilities is by implementing explicit allowlists or using Data Transfer Objects (DTOs) for secure property binding. This Skill provides BAD and GOOD code examples demonstrating how to safely map user input to application models.

Mass assignment leads to privilege escalation when attackers manipulate user input to set sensitive fields like isAdmin. If an API directly binds incoming JSON fields to a User model, this Skill can flag the vulnerability and prevent unauthorized data modification.

Yes, you can use this Skill to review user profile update APIs for parameter injection. It focuses on identifying insecure direct object updates from user input, detecting if your API directly binds incoming JSON fields to models and preventing privilege escalation.

You should use Data Transfer Objects (DTOs) instead of direct model binding whenever handling user-supplied data for object creation or updates. This Skill highlights scenarios where direct autobinding allows parameter injection, demonstrating DTOs as a secure alternative for property binding.