Prisma Missing Input Validation

Description

Passing req.body directly to Prisma where/data allows users to filter by unauthorized fields and bypass access controls.

What Shoulder detects

Prisma {operation} uses unvalidated user input. Validate and whitelist fields before passing to Prisma.

How to fix

Validate and whitelist fields with Zod before Prisma queries.

```typescript
import { z } from 'zod';

const getUsersInput = z.object({
  role: z.enum(['user', 'moderator']).optional(),
  status: z.enum(['active', 'inactive']).optional()
});

async function getUsers(req: Request) {
  const input = getUsersInput.parse(req.query);
  return await prisma.user.findMany({ where: input });
}
```

Learn more: https://shoulder.dev/learn/typescript/cwe-20/prisma-missing-input-validation