Fix Mass Assignment in Javalin
Mass Assignment in Javalin occurs when the framework's 'bodyAsClass()' method is used to bind raw JSON input directly to internal domain models or database entities. This 'over-posting' flaw allows an attacker to manipulate sensitive fields—like 'isAdmin', 'balance', or 'role'—simply by including them in the request body. If your POJO mirrors your database schema, you're handing the keys to the kingdom to anyone with a proxy.
The Vulnerable Pattern
// Sensitive Entity public class User { public String username; public String email; public boolean isAdmin; // Attacker target }
// Vulnerable Endpoint app.patch(“/api/user/update”, ctx -> { User user = ctx.bodyAsClass(User.class); // Attacker sends: {“username”: “hacker”, “isAdmin”: true} // Javalin binds ‘isAdmin’ automatically userService.update(user); });
The Secure Implementation
To kill Mass Assignment, you must decouple your API contract from your data model. Use DTOs that only contain the fields intended for user modification. By binding the request to a DTO and then manually (or via a strict mapper) transferring those values to your actual Entity, you create a whitelist. Any extra fields sent by an attacker in the JSON payload are simply ignored by the DTO, preventing unauthorized state changes.
// 1. Define a strict DTO (Data Transfer Object) public class UserUpdateDTO { public String username; public String email; // 'isAdmin' is omitted here }// 2. Secure Endpoint using explicit mapping app.patch(“/api/user/update”, ctx -> { UserUpdateDTO dto = ctx.bodyAsClass(UserUpdateDTO.class); User existingUser = userService.getCurrentUser(ctx);
// Manual Whitelisting if (dto.username != null) existingUser.setUsername(dto.username); if (dto.email != null) existingUser.setEmail(dto.email); userService.update(existingUser);
});
Your Javalin API
might be exposed to Mass Assignment
74% of Javalin apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.