Mass Assignment (ARCH4129)

Key java.security.mass-assignment · Severity warning · Category security · CWE CWE-915

Binding an entire request body directly to an entity without an allowlist lets attackers set protected fields like role or isAdmin. Use a DTO that carries only the permitted fields.

Incorrect

@PostMapping("/users")
User create(@RequestBody User user) { // binds every field including role, isAdmin
    return repository.save(user);
}

Correct

@PostMapping("/users")
User create(@RequestBody UserCreateDto dto) { // only allowlisted fields
    User user = new User();
    user.setName(dto.name());
    user.setEmail(dto.email());
    return repository.save(user);
}

Fix

Use a DTO with allowlisted fields instead of binding the request body directly to the entity.