sc-mass-assignment

Prevent mass assignment and over-posting by requiring explicit field filtering via whitelisting, DTOs, or framework protections like Laravel's fillable or Rails strong parameters. This ensures only allowed fields bind to data models during creation or updates.

Yes, it detects unsafe binding patterns across popular web frameworks supporting endpoints that bind req.body, request.POST, or similar inputs to model creation or updates. It provides concrete remediation using framework protections like Laravel's fillable and Rails strong parameters.

Over-posting occurs when an API binds the entire request body directly to a data model without filtering fields, allowing attackers to set protected attributes like isAdmin, role, price, or verified. The scan reports these unfiltered request body binding vulnerabilities.

Fix over-posting by applying explicit field filtering via whitelisting, DTOs, or framework protections before binding req.body to data models. The scan provides concrete remediation strategies and examples to secure endpoints by validating input and whitelisting allowed fields.

DTOs are one effective mitigation, but you can also use explicit field whitelisting or framework protections like Laravel's fillable and Rails strong parameters. The scan identifies missing protections and guides safe binding practices across supported frameworks.