Mass Assignment (ARCH9129)

Key swift.security.mass-assignment · Severity warning · Category security · CWE CWE-915

Flags a Fluent model decoded straight from the request body and saved - every column is writable from the request.

Incorrect

let user = try req.content.decode(User.self)
try await user.save(on: req.db)

Correct

let dto = try req.content.decode(CreateUserDto.self)
let user = User(name: dto.name)

Fix

Decode a DTO with the allowed fields and map explicitly.