How to Fix Mass Assignment Vulnerabilities

In this tutorial, you'll learn about How to Fix Mass Assignment Vulnerabilities. We cover key concepts, practical examples, and best practices.

Mass assignment vulnerabilities occur when an application binds all request parameters to model attributes without filtering, allowing attackers to set fields like is_admin, role, or balance by including them in the request.

Quick Fix

Wrong

struct User {
    std::string name;
    std::string email;
    bool isAdmin = false;
};

app.post("/register", [](Request& req, Response& res) {
    User user;
    user.name = req.param("name");
    user.email = req.param("email");
    user.isAdmin = req.param("is_admin") == "true";  // missing from form but sent in request
    db.insert(user);
});

An attacker can register as admin by sending POST /register name=a&email=a@a.com&is_admin=true.

Right

app.post("/register", [](Request& req, Response& res) {
    User user;
    user.name = req.param("name");
    user.email = req.param("email");
    // isAdmin is never set from request
    db.insert(user);
});

Fix with allowlist

std::set<std::string> allowedFields = {
    "name", "email", "password"
};

for (const auto& [key, value] : req.params()) {
    if (allowedFields.contains(key)) {
        user.setField(key, value);
    }
}

Fix with DTO pattern

struct RegisterDTO {
    std::string name;
    std::string email;
    std::string password;
};

app.post("/register", [](Request& req, Response& res) {
    RegisterDTO dto = parseBody<RegisterDTO>(req.body());
    User user = createUser(dto);
    db.insert(user);
});

Fix for API updates

app.patch("/user/:id", [](Request& req, Response& res) {
    int userId = std::stoi(req.param("id"));
    if (userId != req.session.userId) {
        res.status(403).send("Forbidden");
        return;
    }

    std::set<std::string> updatable = {"name", "email", "phone"};
    for (const auto& [key, value] : jsonBody) {
        if (!updatable.contains(key)) {
            res.status(400).send("Cannot update " + key);
            return;
        }
    }
    // apply updates
});

Prevention

• Never automatically bind request parameters to model objects.
• Define explicit allowlists for which fields can be set from user input.
• Use Data Transfer Objects (DTOs) for API input.
• Keep admin and internal fields separate from user-modifiable fields.
• Verify field-level permissions in update operations.

DodaTech Tools

Doda Browser's mass assignment scanner sends requests with extra parameters to detect unprotected fields. DodaZIP archives API schemas for review. Durga Antivirus Pro detects mass assignment payloads in API traffic.

Common Mistakes with assignment

1. Mixing let bindings with <- bindings in do notation, producing type errors
2. Overlapping type class instances that cause GHC to reject the program with ambiguous dispatch errors
3. Non-exhaustive pattern matches that compile with warnings then crash at runtime

These mistakes appear frequently in real-world MASS code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ