Protection for mass-assignment vulnerabilities for modella.
$ component install modella/protection
$ npm install modella-protection
modella-protection provides model#protectedSet to set attributes using
protection.
Protection can be used in either a whitelist or blacklist mode. In white list mode,
only attributes with protected: false are able to be set by mass assignment.
In black list mode, only variables with protected: true will be filtered from
mass-assignment. The default is blacklist mode.
Model.whiteListProtection = true //Switch from the default to whitelist mode.
To protect a field, pass in the protected: true option.
User.attr('username').attr('admin', { protected: true });
var user = new User();
var changedFields = user.protectedSet({username: 'Bobby', admin: true});
// Changed fields = {username: 'Bobby'};
user.get('admin') === undefined // true
User.attr('preferences', { type: 'object', protected: { modifiedAt: true }});
var user = new User();
user.setProtected({
preferences: { sendEmails: true, sendSms: true, modifiedAt: new Date() }
});
user.preferences().modifiedAt === undefined // true
user.preferences().sendEmails == true // true
MIT