modella/modella — pull request #8 by rschmukler (2013-05-01 20:45:05+00:00)
Title: Implemented Mass-Assignment Protection

Right now, modella has no protection against mass assignment. Consider the following bit of code for updating a users profile:

app.post('/user', function(req, res, next) {
var currentUser = req.user;
currentUser.set(req.body);
currentUser.save(next);
});

This seems innocent enough, but what if we have `User.attr('admin')` and a malicious decides to submit a form with `admin=true`. Well, now we're hosed.

This PR implements a fix on `Model#set` to check whether or not the attribute has the `massAssignable` option.

It currently defaults to a blacklist, ie. only attributes with `massAssignable === false` will be ignored (so you'd define something like: `User.attr('admin', {massAssignable: false});`)

It also supports white listing by setting `User.whiteListMassAssignable = true`, in which case any attribute that isn't explicitly set to `massAssignable: true` will be filtered out of `.set`.

Lastly, it provides an override in the form of `Model.set(obj, ignoreMassAssignable)`. This is useful for things like the sync layer's `proto.save`, which uses `.set` and shouldn't worry about mass-assignment since it's setting from the database.

It could be argued that this should be a plugin, but since it is such a large security flaw, I figured it should go in core. Additionally, the implementation would be very difficult as a plugin.

Let me know what you think.