# Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

**Stack:** JavaScript

- Prevalence: Wysoka Często wykorzystywana
- Impact: Krytyczny 2 reguł o krytycznym poziomie
- Prevention: Udokumentowane 5 przykładów poprawek

**OWASP:** Injection (A03:2021-Injection) - #3

## Description

If the object contains attributes that are not intended to be modified, then an attacker can use the vulnerability to overwrite critical application values, gain privileges, or bypass security checks.

## Prevention

Strategie zapobiegania dla Mass Assignment oparte na 2 regułach detekcji Shoulder.

### JavaScript

Validate input with Zod schema and use explicit field assignment instead of spreading req.body

Use explicit field assignment or class-transformer with excludeExtraneousValues instead of spreading req.body

## Warning Signs

- [CRITICAL] ... uses unvalidated user input in data parameter. Use explicit field whitelisting with validation.
- [CRITICAL] Entity properties assigned directly from user input without whitelisting. This allows unauthorized field modification.

## Consequences

- Uzyskanie uprawnień
- Obejście mechanizmu ochrony
- Modyfikacja danych aplikacji

## Mitigations

- Do mass assignment stosuj listę dozwolonych atrybutów
- Wdroż prawidłową walidację wejścia, by odrzucać nieoczekiwane atrybuty
- Stosuj obiekty DTO (Data Transfer Objects), aby kontrolować, które pola mogą być modyfikowane

## Detection

- Total rules: 5
- Critical: 2
- Languages: python, javascript, typescript

## Rules by Language

### Javascript (2 rules)

- **Prisma Mass Assignment Vulnerability** [CRITICAL]: Spreading req.body into Prisma create/update allows attackers to modify
protected fields like role, credits, or permissions.
  - Remediation: Use explicit field assignment instead of spreading req.body.

```typescript
const input = createUserSchema.parse(req.body);
const user = await prisma.user.create({
  data: {
    email: input.email,
    name: input.name
    // role not assigned from user input
  }
});
```

Learn more: https://shoulder.dev/learn/typescript/cwe-915/prisma-mass-assignment
- **TypeORM Mass Assignment Vulnerability** [CRITICAL]: Directly assigning req.body to entities allows attackers to modify protected
fields like role, isAdmin, or credits.
  - Remediation: Use explicit field assignment instead of spreading request data.

```typescript
const user = repository.create({
  username: req.body.username,
  email: req.body.email
  // role and isAdmin not assigned from user input
});
```

Learn more: https://shoulder.dev/learn/typescript/cwe-915/mass-assignment

### Typescript (2 rules)

- **Prisma Mass Assignment Vulnerability** [CRITICAL]: Spreading req.body into Prisma create/update allows attackers to modify
protected fields like role, credits, or permissions.
  - Remediation: Use explicit field assignment instead of spreading req.body.

```typescript
const input = createUserSchema.parse(req.body);
const user = await prisma.user.create({
  data: {
    email: input.email,
    name: input.name
    // role not assigned from user input
  }
});
```

Learn more: https://shoulder.dev/learn/typescript/cwe-915/prisma-mass-assignment
- **TypeORM Mass Assignment Vulnerability** [CRITICAL]: Directly assigning req.body to entities allows attackers to modify protected
fields like role, isAdmin, or credits.
  - Remediation: Use explicit field assignment instead of spreading request data.

```typescript
const user = repository.create({
  username: req.body.username,
  email: req.body.email
  // role and isAdmin not assigned from user input
});
```

Learn more: https://shoulder.dev/learn/typescript/cwe-915/mass-assignment