class

Flaw::MassAssignment

Inherits Flaw::Rule < Reference < Object

FLAW015 — Mass assignment. A JSON::Serializable / YAML::Serializable struct exposes admin/role/permission/is_* fields as writable — deserialising untrusted payloads lets the client set them.

Constants

PRIV_FIELD = /\bproperty\s+(is_admin|admin|role|roles|permissions?|scopes?|owner_id|user_id|superuser|staff)\b/

Only property makes a field writable under Serializable; getter is read-only and safe even on admin-like fields.

Instance methods

check(source : String, path : String) : Array(Finding)
Source
default_severity
Source
description
Source
title
Source