# Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

**Stack:** JavaScript

- Prevalence: 高 频繁被利用
- Impact: 关键 2 条严重级别为关键的规则
- Prevention: 已记录 5 个修复示例

**OWASP:** Injection (A03:2021-Injection) - #3

## Description

If the object contains attributes that are not intended to be modified, then an attacker can use the vulnerability to overwrite critical application values, gain privileges, or bypass security checks.

## Prevention

基于 2 条 Shoulder 检测规则的 Mass Assignment 预防策略。

### JavaScript

Validate input with Zod schema and use explicit field assignment instead of spreading req.body

Use explicit field assignment or class-transformer with excludeExtraneousValues instead of spreading req.body

## Warning Signs

- [CRITICAL] ... uses unvalidated user input in data parameter. Use explicit field whitelisting with validation.
- [CRITICAL] Entity properties assigned directly from user input without whitelisting. This allows unauthorized field modification.

## Consequences

- 获取权限
- 绕过保护机制
- 修改应用程序数据

## Mitigations

- 对批量赋值使用允许属性的允许列表
- 实施适当的输入验证以拒绝意外的属性
- 使用数据传输对象 (DTO) 来控制可修改的字段

## Detection

- Total rules: 5
- Critical: 2
- Languages: python, javascript, typescript

## Rules by Language

### Javascript (2 rules)

- **Prisma Mass Assignment Vulnerability** [CRITICAL]: Spreading req.body into Prisma create/update allows attackers to modify
protected fields like role, credits, or permissions.
  - Remediation: Use explicit field assignment instead of spreading req.body.

```typescript
const input = createUserSchema.parse(req.body);
const user = await prisma.user.create({
  data: {
    email: input.email,
    name: input.name
    // role not assigned from user input
  }
});
```

Learn more: https://shoulder.dev/learn/typescript/cwe-915/prisma-mass-assignment
- **TypeORM Mass Assignment Vulnerability** [CRITICAL]: Directly assigning req.body to entities allows attackers to modify protected
fields like role, isAdmin, or credits.
  - Remediation: Use explicit field assignment instead of spreading request data.

```typescript
const user = repository.create({
  username: req.body.username,
  email: req.body.email
  // role and isAdmin not assigned from user input
});
```

Learn more: https://shoulder.dev/learn/typescript/cwe-915/mass-assignment

### Typescript (2 rules)

- **Prisma Mass Assignment Vulnerability** [CRITICAL]: Spreading req.body into Prisma create/update allows attackers to modify
protected fields like role, credits, or permissions.
  - Remediation: Use explicit field assignment instead of spreading req.body.

```typescript
const input = createUserSchema.parse(req.body);
const user = await prisma.user.create({
  data: {
    email: input.email,
    name: input.name
    // role not assigned from user input
  }
});
```

Learn more: https://shoulder.dev/learn/typescript/cwe-915/prisma-mass-assignment
- **TypeORM Mass Assignment Vulnerability** [CRITICAL]: Directly assigning req.body to entities allows attackers to modify protected
fields like role, isAdmin, or credits.
  - Remediation: Use explicit field assignment instead of spreading request data.

```typescript
const user = repository.create({
  username: req.body.username,
  email: req.body.email
  // role and isAdmin not assigned from user input
});
```

Learn more: https://shoulder.dev/learn/typescript/cwe-915/mass-assignment