SecurityInput validation

security/no-untrusted-mass-assignment

Project or validate an explicit field allowlist before request objects or spreads reach persistence and assignment sinks.

mass-assignmentpersistenceallowlist

01 Examples

TypeScript

await db.user.update({ where: { id }, data: req.body });

Finding

Disallow wholesale persistence of request objects.

02 Enable it

Setup

Install the package, register its plugin factory, then enable the rule.

pnpm add -D @scruple/security

In scruple.config.ts, register the factory under the security namespace used by the rule ID.

import { security } from "@scruple/security";

plugins: {
  "security": security(),
},

"security/no-untrusted-mass-assignment": "warn"