Mass assignment (ARCH3129)

Key typescript.security.mass-assignment · Severity warning · Category security · CWE CWE-915

Passing the whole request body straight into an ORM create/update call lets attackers set protected fields such as isAdmin. Select only allowed fields.

Incorrect

app.post("/users", async (req, res) => {
  const user = await User.create(req.body);
  res.json(user);
});

Correct

app.post("/users", async (req, res) => {
  const { name, email, password } = req.body;
  const user = await User.create({ name, email, password });
  res.json(user);
});

Fix

Never pass the raw request body into ORM writes; pick fields through an explicit allowlist.