Fix Mass Assignment in Fresh
Mass Assignment in Fresh (Deno) occurs when untrusted user input is directly spread into application state or database models. In the context of Fresh handlers, this typically happens when processing JSON bodies or FormData without explicit property whitelisting, allowing attackers to escalate privileges by overwriting sensitive fields like 'isAdmin' or 'role'.
The Vulnerable Pattern
export const handler = async (req: Request, ctx: HandlerContext): Promise=> { const body = await req.json(); const kv = await Deno.openKv(); const userKey = ["users", ctx.state.userId]; const { value: existing } = await kv.get(userKey); // VULNERABLE: Direct spread of ‘body’ allows overwriting any property const updatedUser = { …existing, …body }; await kv.set(userKey, updatedUser);
return new Response(“Profile updated”); };
The Secure Implementation
The vulnerability stems from the '...body' syntax which merges all keys from the request into the user object. An attacker sending '{"isAdmin": true}' would gain administrative access. The fix involves implementing a strict whitelist. Using a validation library like Zod ensures that only 'displayName' and 'bio' are extracted from the request body, effectively stripping any malicious properties before they reach the persistence layer.
import { z } from "https://deno.land/x/zod/mod.ts";const ProfileSchema = z.object({ displayName: z.string().max(50), bio: z.string().max(200), });
export const handler = async (req: Request, ctx: HandlerContext): Promise
=> { const body = await req.json(); const kv = await Deno.openKv(); const userKey = [“users”, ctx.state.userId]; const { value: existing } = await kv.get(userKey); // SECURE: Validate and whitelist only specific fields const result = ProfileSchema.safeParse(body); if (!result.success) return new Response(“Invalid Input”, { status: 400 });
const updatedUser = { …existing, …result.data }; await kv.set(userKey, updatedUser);
return new Response(“Profile updated”); };
Your Fresh API
might be exposed to Mass Assignment
74% of Fresh apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.