Fix Mass Assignment in Polka
Mass Assignment in Polka occurs when you blindly spread `req.body` into your data models. It's a classic over-posting vulnerability that lets attackers overwrite internal fields like `role`, `isAdmin`, or `password_reset_token` by simply adding them to the JSON payload. Polka's minimalism means it won't save you; you have to handle the sanitization yourself.
The Vulnerable Pattern
const polka = require('polka'); const { json } = require('body-parser');
polka() .use(json()) .post(‘/api/user/update’, (req, res) => { const user = db.users.find(req.session.userId); // VULNERABLE: Directly assigning req.body allows attackers to pass {“role”: “admin”} Object.assign(user, req.body); user.save(); res.end(‘Updated’); }) .listen(3000);
The Secure Implementation
The vulnerability stems from trusting the structure of the input object. By using ES6 destructuring, we create a strict whitelist. Even if an attacker sends additional properties in the JSON body, they are never assigned to the internal model. In high-stakes environments, consider using a schema validator like Joi or Zod to enforce types and strip unknown keys before the data ever reaches your logic.
const polka = require('polka'); const { json } = require('body-parser');polka() .use(json()) .post(‘/api/user/update’, (req, res) => { const user = db.users.find(req.session.userId);
// SECURE: Explicitly whitelist allowed fields using destructuring const { displayName, bio, avatarUrl } = req.body; const updates = { displayName, bio, avatarUrl }; // Only apply the controlled subset Object.assign(user, updates); user.save(); res.end('Updated Securely');
}) .listen(3000);
Your Polka API
might be exposed to Mass Assignment
74% of Polka apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.