Code RoomMass assignment vulnerability in FastAPI

HardPrep Room Coding #1672

Mass assignment vulnerability in FastAPI

Code reviewSecuritySenior–Staff~30 min

Review this Python (FastAPI + SQLAlchemy) profile-update endpoint.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 30 min

Mark a line and say what kind of problem it is.0 findings

1@router.patch('/me')

2def update_me(updates: dict, db: Session = Depends(get_db),

3 user: User = Depends(current_user)):

4 for field, value in updates.items():

5 setattr(user, field, value)

6 db.add(user)

7 db.commit()

8 return {'ok': True}

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.