Mass-Assignment Prevention Through Explicit Request Schemas
Description
Application create and update handlers use explicit, per-operation request schemas that accept only client-controlled fields and reject or ignore server-managed attributes such as tenant, workspace, owner, role, visibility, and deployment state. The allowed fields are maintained independently for each endpoint, preventing automatic model binding or generic object merging from persisting attacker-supplied privileged attributes. This control addresses mass-assignment weaknesses; object-level authorization remains a separate complementary control under CME-908.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | A trivial request-body modification no longer reaches server-managed fields. To achieve the same unauthorized state change, an attacker must find an unprotected create or update path, bypass the explicit request schema, or exploit a separate serialization or authorization defect. |
CWE Relationships
Verification
For every create and update endpoint, run authenticated negative tests that supply a foreign tenant, workspace, owner, role, or other server-managed field. Each request must be rejected or the supplied field must be ignored; a subsequent read must confirm that the persisted object retains its original server-managed state.
# Expected: ^(400|403|404)$
# Expected: ^true$
# Expected: ^(400|403)$