Mass Assignment Cheat Sheet - Revision history

Dominique RIGHETTO: Point to the official site

2019-07-15T14:17:55Z

Point to the official site

Thunder-Son: Migration to GitHub

2019-02-14T13:03:56Z

Migration to GitHub

Show changes

Aabashkin: /* Data Transfer Objects (DTOs) */

2016-12-21T23:31:32Z

‎Data Transfer Objects (DTOs)

Aabashkin: NodeJS code sample update

2016-12-20T20:43:58Z

NodeJS code sample update

Aabashkin: Missing quote in code example

2016-12-20T18:38:32Z

Missing quote in code example

Aabashkin: /* Play */

2016-03-10T23:38:13Z

‎Play

Aabashkin: NodeJS update

2016-03-10T23:19:28Z

NodeJS update

Jmanico at 01:31, 21 February 2016

2016-02-21T01:31:22Z

Jmanico: /* Definition */

2016-02-21T01:30:29Z

‎Definition

Jmanico: /* Language & Framework Specific Solutions */

2016-02-21T01:25:59Z

‎Language & Framework Specific Solutions

← Older revision		Revision as of 14:17, 15 July 2019
Line 4:		Line 4:
	The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!		The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!

−	Please visit [https://~~github~~.~~com/OWASP/CheatSheetSeries/blob/master~~/cheatsheets/Mass_Assignment_Cheat_Sheet.md Mass Assignment Cheat Sheet] to see the latest version of the cheat sheet.	+	Please visit [https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html Mass Assignment Cheat Sheet] to see the latest version of the cheat sheet.

@@ Line 89: / Line 89: @@
        private String email;
-       //private boolean isAdmin;
+       //NOTE: isAdmin field is not present
        //Getters & Setters

@@ Line 135: / Line 135: @@
       password  : String,
       email     : String,
-      admin     : Boolean,
+      isAdmin   : Boolean,
     });
@@ Line 158: / Line 158: @@
       password  : String,
       email     : String,
-      admin     : { type: Boolean, protect: true, default: false }
+      isAdmin   : { type: Boolean, protect: true, default: false }
     });
@@ Line 173: / Line 173: @@
     /** Static massUpdate method **/
-    var input = { name: 'bhelx', admin: 'true' };
+    var input = { userid: 'bhelx', isAdmin: 'true' };
     User.update({ '_id': someId }, { $set: User.massUpdate(input) }, console.log);

@@ Line 41: / Line 41: @@
 Here is the controller handling the request:
-    @RequestMapping(value = "/addUser, method = RequestMethod.POST)
+    @RequestMapping(value = "/addUser", method = RequestMethod.POST)
     public String submit(User user) {

@@ Line 235: / Line 235: @@
 == Play ==
-[https://www.playframework.com/documentation/1.1.1/controllers Reference]
+[https://www.playframework.com/documentation/1.4.x/controllers#nobinding Reference]
 == Jackson (JSON Object Mapper) ==

@@ Line 66: / Line 66: @@
 * Attacker can guess common sensitive fields
 * Attacker has access to source code and can review the models for sensitive fields
-* The object with sensitive fields has an empty constructor
+* AND the object with sensitive fields has an empty constructor
 === Case Studies ===
 ==== GitHub ====
 In 2012, GitHub was hacked using mass assignment. A user was able to upload his public key to any organization and thus make any subsequent changes in their repositories. [https://github.com/blog/1068-public-key-security-vulnerability-and-mitigation GitHub's Blog Post]
 === Solutions ===
@@ Line 76: / Line 78: @@
 * Blacklist the non-bindable, sensitive fields
 * Use Data Transfer Objects (DTOs)
 = General Solutions =
@@ Line 125: / Line 128: @@
 == NodeJS + Mongoose ==
 [https://www.npmjs.com/package/mongoose-mass-assign Reference]

@@ Line 9: / Line 9: @@
 = Introduction =
 === Definition ===
-"Modern frameworks allow developers to automatically bind HTTP request parameters from both request query and body into model objects for ease of development and increased productivity. If the binder is not correctly configured to control which HTTP request parameters are bound to which model attributes, an attacker may be able to abuse the model binding process and set any other attributes that should not be exposed to user control. This binding is possible even if the model attributes do not appear in the web forms or API contracts." - [http://www.hpenterprisesecurity.com/vulncat/en/vulncat/java/mass_assignment_sensitive_field_exposure.html Mass Assignment: Sensitive Field Exposure]
+Software frameworks sometime allow developers to automatically bind HTTP request parameters into program code variables or objects to make using that framework easier on developers. This can sometimes cause harm. Attackers can sometimes use this methodology to create new parameters that the developer never intended which in turn creates or overwrites new variable or objects in program code that was not intended. This is called a <i>mass assignment</i> vulnerability.
 === Alternative Names ===

@@ Line 128: / Line 128: @@
+    }
 [http://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/validation/DataBinder.html#setDisallowedFields-java.lang.String...- Reference]
 == NodeJS + Mongoose ==
 [https://www.npmjs.com/package/mongoose-mass-assign Reference]
 == Ruby On Rails ==
 [http://guides.rubyonrails.org/v3.2.9/security.html#mass-assignment Reference]
 == Django ==
 [https://coffeeonthekeyboard.com/mass-assignment-security-part-10-855/ Reference]
 == ASP.NET ==
 [http://odetocode.com/Blogs/scott/archive/2012/03/11/complete-guide-to-mass-assignment-in-asp-net-mvc.aspx Reference]
 == PHP Laravel + Eloquent ==
@@ Line 194: / Line 189: @@
 == Grails ==
 [http://spring.io/blog/2012/03/28/secure-data-binding-with-grails/ Reference]
 == Play ==
 [https://www.playframework.com/documentation/1.1.1/controllers Reference]
 == Jackson (JSON Object Mapper) ==
 [http://www.baeldung.com/jackson-field-serializable-deserializable-or-not Reference]
 [http://lifelongprogrammer.blogspot.com/2015/09/using-jackson-view-to-protect-mass-assignment.html Reference]
 == GSON (JSON Object Mapper) ==
 [https://sites.google.com/site/gson/gson-user-guide#TOC-Excluding-Fields-From-Serialization-and-Deserialization Reference]
 [http://stackoverflow.com/a/27986860 Reference]
 == JSON-Lib (JSON Object Mapper) ==
 [http://json-lib.sourceforge.net/advanced.html Reference]
 == Flexjson (JSON Object Mapper) ==
 [http://flexjson.sourceforge.net/#Serialization Reference]
 = Authors and Primary Editors =