Fix Mass Assignment in Bottle
Mass Assignment in Bottle occurs when the application takes raw user input (request.json or request.forms) and binds it directly to internal database models or objects without filtering. This allows an attacker to overwrite sensitive fields such as 'is_admin', 'role', or 'balance' by simply adding them to the JSON payload.
The Vulnerable Pattern
from bottle import post, request
import db
@post(‘/api/profile/update’)
def update_profile():
user_id = get_session_user_id()
user = db.get_user(user_id)
# VULNERABLE: Directly unpacking untrusted request data into the model
# An attacker can send {"is_admin": true} to escalate privileges
data = request.json
user.update_attributes(**data)
user.save()
return {"status": "success"}</code></pre>
The Secure Implementation
The exploit leverages the dynamic nature of Python's **kwargs. In the vulnerable snippet, 'user.update_attributes(**data)' blindly maps every key in the JSON body to a model attribute. The fix implements a strict whitelist ('ALLOWED_FIELDS') to ensure only non-sensitive attributes are modified. For robust applications, integrating a schema validation library like Marshmallow or Pydantic is recommended to enforce both field presence and data types.
from bottle import post, request, abort
import db
Define a strict whitelist of editable fields
ALLOWED_FIELDS = {‘bio’, ‘display_name’, ‘timezone’}
@post(‘/api/profile/update’)
def update_profile():
user_id = get_session_user_id()
user = db.get_user(user_id)
data = request.json
if not data:
abort(400, "Missing payload")
# SECURE: Filter input against the whitelist
sanitized_data = {k: v for k, v in data.items() if k in ALLOWED_FIELDS}
user.update_attributes(**sanitized_data)
user.save()
return {"status": "success"}</code></pre>
Your Bottle API
might be exposed to Mass Assignment
74% of Bottle apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.