Fix Mass Assignment in Symfony

/**
 * VULNERABLE: Direct Entity Binding
 * If UserType includes 'roles' or uses a permissive configuration, 
 * an attacker can escalate privileges via the request payload.
 */
public function updateProfile(Request $request, User $user) {
    $form = $this->createForm(UserType::class, $user);
    $form->handleRequest($request);
if ($form->isSubmitted() && $form->isValid()) {
    $this->entityManager->flush();
}
}

/**
 * SECURE: Data Transfer Object (DTO) Pattern
 * The DTO acts as a strict allow-list contract.
 */
class ProfileUpdateDTO {
    #[Assert\NotBlank]
    public string $username;
#[Assert\Email]
public string $email;
}
public function updateProfile(Request $request, User $user) {
$dto = new ProfileUpdateDTO();
$form = $this->createForm(ProfileUpdateType::class, $dto);
$form->handleRequest($request);
if ($form->isSubmitted() && $form->isValid()) {
    // Manual mapping ensures only authorized fields reach the Entity
    $user->setUsername($dto->username);
    $user->setEmail($dto->email);
    $this->entityManager->flush();
}
}