Mass Assignment in Sinatra occurs when an application blindly sinks user-controlled input (like the `params` hash) into an ORM model's constructor or update method. This allows an attacker to manipulate internal object attributes—such as `is_admin`, `role`, or `account_balance`—that were never intended to be user-editable. If you are using ActiveRecord or Sequel with Sinatra, failing to whitelist parameters is a critical security debt.

The Vulnerable Pattern

post '/user/update' do
  @user = User.find(session[:user_id])
  # VULNERABLE: Direct injection of the params hash into the database update method.
  # An attacker can send 'user[admin]=true' to escalate privileges.
  @user.update(params[:user])
  json({ status: 'success' })
end

The Secure Implementation

The vulnerability exists because ORMs map hash keys directly to table columns. To mitigate this, you must implement a 'Permitted Parameters' pattern. In the secure example, we use Ruby's `slice` method to create a new hash containing only the keys we explicitly trust. Even if an attacker injects `admin=true` into the request, the `slice` method will ignore it, preventing the ORM from ever seeing the malicious payload. For complex apps, consider using the 'strong_parameters' gem or a dedicated dry-validation schema.

post '/user/update' do
  @user = User.find(session[:user_id])
SECURE: Explicitly whitelist allowed attributes using Hash#slice
This ensures only ‘bio’ and ‘display_name’ are processed.
permitted_params = params[:user].slice(‘bio’, ‘display_name’)
if @user.update(permitted_params)
json({ status: ‘success’ })
else
status 400
end
end