Mass assignment (ARCH2129)

Key python.security.mass-assignment · Severity warning · Category security · CWE CWE-915

Assigning a whole request body straight to an ORM model lets an attacker also set protected fields like is_admin. Only expected fields should be accepted, via an allowlist.

Incorrect

def update_profile(request):
    user = User.objects.get(pk=request.user.id)
    for key, value in request.POST.items():
        setattr(user, key, value)
    user.save()

Correct

ALLOWED = {"display_name", "bio", "avatar_url"}

def update_profile(request):
    user = User.objects.get(pk=request.user.id)
    for key in ALLOWED & request.POST.keys():
        setattr(user, key, request.POST[key])
    user.save()

Fix

Restrict updatable fields to an explicit allowlist; never bind the request body straight to the model.