Mass assignment (ARCH340)

Key dotnet.security.mass-assignment · Severity warning · Category security · CWE CWE-915

When an action binds the whole request into a type and hands that same object to Add, Update or Attach, every bindable property - IsAdmin, Balance, OwnerId - is whatever the caller sent. TryUpdateModelAsync(entity) without an include list has the same effect.

Incorrect

[HttpPost]
public IActionResult Create(User user)
{
    _db.Users.Add(user);
    _db.SaveChanges();
    return Ok();
}

Correct

[HttpPost]
public IActionResult Create(CreateUserRequest request)
{
    var user = new User { Name = request.Name, Email = request.Email };
    _db.Users.Add(user);
    _db.SaveChanges();
    return Ok();
}

Fix

Bind a request DTO and copy only the allowed properties onto the entity, or pass the property allowlist overload of TryUpdateModelAsync.