Mass Assignment (ARCH8129)

Key kotlin.security.mass-assignment · Severity warning · Category security · CWE CWE-915

Flags a @RequestBody bound straight to a persisted entity and saved - every column, including the protected ones, is writable from the request.

Incorrect

@PostMapping fun create(@RequestBody user: User) = repo.save(user)

Correct

@PostMapping fun create(@RequestBody dto: CreateUserDto) = repo.save(dto.toEntity())

Fix

Bind requests to a DTO with the allowed fields and map explicitly.