Mass Assignment

Mass assignment occurs when a framework automatically binds HTTP request parameters to model fields. If all fields are accepted, attackers can set fields they should not control.

Vulnerable Node.js/Mongoose:

app.put("/users/:id", async (req, res) => {
  // VULNERABLE: spreads all request body fields into user object
  const user = await User.findByIdAndUpdate(
    req.params.id,
    { $set: req.body },  // Attacker can set any field!
    { new: true }
  );
  res.json(user);
});
// Attacker sends: { "name": "Alice", "isAdmin": true, "creditBalance": 1000000 }

Rails strong parameters bypass:

# Vulnerable — permits all params
User.update(params[:user])  # Without permit() filter

# Attacker sends: user[role]=admin

This vulnerability was behind the GitHub mass assignment vulnerability in 2012, where an attacker added their SSH key to an organization repo by setting the org_id field.

The fix is to explicitly specify which fields are allowed to be set through user input, either via allowlists or Data Transfer Objects.

Explicit field allowlist (Node.js):

const ALLOWED_UPDATE_FIELDS = ["name", "email", "bio", "avatarUrl"];

app.put("/users/:id", authenticate, async (req, res) => {
  // Only pick allowed fields — ignore everything else
  const updates = {};
  for (const field of ALLOWED_UPDATE_FIELDS) {
    if (field in req.body) {
      updates[field] = req.body[field];
    }
  }
  const user = await User.findByIdAndUpdate(
    req.params.id,
    { $set: updates },
    { new: true }
  );
  res.json(user);
});

Data Transfer Object (TypeScript):

interface UpdateUserDTO {
  name?: string;
  email?: string;
  bio?: string;
  // Note: no isAdmin, role, or creditBalance!
}

async function updateUser(id: string, dto: UpdateUserDTO) {
  return User.findByIdAndUpdate(id, { $set: dto });
}