Mass Assignment (ARCH5129)

Key go.security.mass-assignment · Severity warning · Category security · CWE CWE-915

Binding the request body directly to a model and saving it lets an attacker set protected fields such as IsAdmin. Only allowlisted fields should be assigned.

Incorrect

var user User
json.NewDecoder(r.Body).Decode(&user) // every field, incl. IsAdmin
db.Create(&user)

Correct

var req struct {
    Name  string `json:"name"`
    Email string `json:"email"`
}
json.NewDecoder(r.Body).Decode(&req)
user := User{Name: req.Name, Email: req.Email}
db.Create(&user)

Fix

Bind input to a DTO containing only allowlisted fields and populate the model explicitly.