Mass Assignment Updatemodel

Vulnerable vs. safe

TryUpdateModel(user);

TryUpdateModel(user, new[] { "Name", "Email" });

Why it matters & how to fix it

TryUpdateModel/UpdateModel binds every posted form field onto the model without an explicit property allow-list, enabling mass assignment / over- posting of sensitive properties (e.g. IsAdmin, roles, prices) (CWE-915). Pass an explicit includeProperties list, bind to a purpose-built view model /DTO, or mark protected properties with [BindNever].

References

• https://cwe.mitre.org/data/definitions/915.html
• https://learn.microsoft.com/en-us/aspnet/core/mvc/models/model-binding

Related checks

• JavaScript / TypeScript - Other Security Checks
  Child Process Shell True
• JavaScript / TypeScript - Other Security Checks
  Open Redirect Tainted Input
• Python - Other Security Checks
  Django Mark Safe
• Python - Other Security Checks
  Flask Debug Enabled
• Python - Other Security Checks
  Flask Render Template String
• Python - Other Security Checks
  Insecure Tempfile Mktemp