Fix Mass Assignment in Beego

Mass Assignment in Beego occurs when a developer binds untrusted HTTP request data directly to an ORM model. By injecting unexpected parameters (e.g., 'IsAdmin=true' or 'Balance=99999'), an attacker can manipulate internal object states that should be restricted to the backend logic.

The Vulnerable Pattern

type User struct {
    Id      int
    Name    string
    IsAdmin bool // Sensitive field
}
func (c *UserController) Post() {
u := User{}
// VULNERABILITY: ParseForm maps all matching request keys to the struct fields
if err := c.ParseForm(&u); err == nil {
orm.NewOrm().Insert(&u)
}
}

The Secure Implementation

To kill Mass Assignment, you must decouple your API's Input Schema from your Database Schema. Use a Data Transfer Object (DTO) or a 'Input Struct' that defines only the fields the user is permitted to touch. By using ParseForm on the DTO instead of the ORM model, you create a strict whitelist. Any extra parameters sent by the attacker will be ignored by the Go runtime because they don't exist in the DTO struct.

type UserRegistrationDTO struct {
    Name string `form:"name"` 
}
func (c *UserController) Post() {
dto := UserRegistrationDTO{}
if err := c.ParseForm(&dto); err != nil {
c.Ctx.Output.SetStatus(400)
return
}
// Explicitly mapping allowed fields to the ORM model
u := User{
    Name:    dto.Name,
    IsAdmin: false, // Hardcoded logic, not from input
}

orm.NewOrm().Insert(&u)
}