Q25: Mass Assignment & Object Injection: Data Transfer Object (DTO) validation and schema enforcement. - Web Security & OWASP (50 Qs)

The Mass Assignment Vulnerability

Mass Assignment occurs when software frameworks automatically bind incoming HTTP JSON body parameters directly to database entity models without an explicit whitelist.

sql

Attacker sends payload:
POST /api/users/profile
{
  "name": "Alice",
  "is_admin": true,          <-- Attacker injects extra parameter!
  "account_balance": 999999  <-- Attacker injects extra parameter!
}

Vulnerable Backend Code:
user.update(req.body); // Directly updates database record with ALL properties!
Result: Privilege escalation to Administrator!

Definitive Defense: Strict DTO Validation (TypeScript & Pydantic v2)

typescript

import { IsString, IsNotEmpty } from 'class-validator';

// 1. Define explicit Data Transfer Object (DTO)
export class UpdateProfileDto {
  @IsString()
  @IsNotEmpty()
  name: string;

  // Notice: 'is_admin' and 'account_balance' are OMITTED!
}

// 2. Configure NestJS / Express validation pipe to strip unrecognized fields:
app.useGlobalPipes(new ValidationPipe({
  whitelist: true,            // Automatically strips non-whitelisted properties
  forbidNonWhitelisted: true  // Throws 400 Bad Request if extra fields are present!
}));