zakirkun Mass Assignment
Overview
Detects frameworks binding raw HTTP payload bodies directly to database models or internal objects without field allow-lists.
Remediation
Use explicitly defined Data Transfer Objects (DTOs) or field allow-lists rather than blindly binding raw JSON to models.