Fix Mass Assignment in FuelPHP

Mass Assignment in FuelPHP is a critical vulnerability where an attacker manipulates HTTP parameters to overwrite sensitive database columns. By piping raw Input::post() arrays directly into an ORM model without filtering, you grant users control over internal fields like 'role', 'is_admin', or 'balance'.

The Vulnerable Pattern

// Controller: Blindly trusting user input
$id = Input::param('id');
$user = Model_User::find($id);
// DANGER: from_array without a whitelist maps every POST key to the DB
$user->from_array(Input::post());
$user->save();

The Secure Implementation

The vulnerability exists because FuelPHP's ORM 'from_array' method, when called with only one argument, iterates through the entire input array and updates corresponding model properties. An attacker can inject 'is_admin=1' into the POST body to escalate privileges. To fix this, you must use the second parameter of 'from_array()' to define an explicit whitelist of permitted fields. This ensures that only the keys you intend to be mutable are processed, effectively discarding any malicious payload keys.

// Controller: Implementing strict whitelisting
$id = Input::param('id');
$user = Model_User::find($id);
// Option 1: Whitelist specific fields in from_array
$allowed_fields = [‘first_name’, ‘last_name’, ‘bio’];
$user->from_array(Input::post(), $allowed_fields);
// Option 2: Manual assignment for high-risk fields
// $user->first_name = Input::post(‘first_name’);
// $user->last_name = Input::post(‘last_name’);
$user->save();