Fix Mass Assignment in CherryPy

Mass Assignment (Overposting) in CherryPy occurs when untrusted request parameters are mapped directly to internal model attributes. In many CherryPy implementations, developers use `**kwargs` to capture all POST/PUT data and pass it straight to a database layer. This allows an attacker to manipulate fields they shouldn't touch, such as 'is_admin', 'role', or 'account_balance' by simply appending them to the request body.

The Vulnerable Pattern

import cherrypy
class ProfileHandler:
@cherrypy.expose
@cherrypy.tools.json_in()
def update(self, **params):
# VULNERABLE: Direct mapping of request parameters to the user object
# If the attacker sends {‘is_admin’: True}, the loop will apply it.
user = db.get_user(cherrypy.session[‘user_id’])
for key, value in params.items():
setattr(user, key, value)
user.save()
return “Profile updated”

The Secure Implementation

The vulnerability stems from the 'Sink'—in this case, `setattr(user, key, value)`—receiving unvalidated input keys from the `**params` dictionary. The fix requires implementing a strict Allowlist (Permit List) pattern. By defining `ALLOWED_KEYS`, you decouple the API interface from your internal data model. Even if an attacker injects 'is_admin=true' into the JSON payload, the dictionary comprehension ensures only authorized fields are processed. For scalable applications, use Marshmallow or Pydantic to validate and deserialize incoming CherryPy request data into strict Data Transfer Objects (DTOs).

import cherrypy
class ProfileHandler:
@cherrypy.expose
@cherrypy.tools.json_in()
def update(self, **params):
# SECURE: Use an explicit allowlist to filter input
ALLOWED_KEYS = {‘bio’, ‘location’, ‘website’}
user = db.get_user(cherrypy.session[‘user_id’])
    # Filter params against the allowlist
    safe_data = {k: v for k, v in params.items() if k in ALLOWED_KEYS}
    
    if not safe_data:
        raise cherrypy.HTTPError(400, "Invalid input")

    for key, value in safe_data.items():
        setattr(user, key, value)
        
    user.save()
    return "Profile updated"</code></pre>