vetkit.php.mass-assignment.laravel-request-all
The whole request payload ($request->all()) is mass-assigned to an Eloquent model. Only the model's $fillable / $guarded lists stop attackers from setting extra attributes.
Last updated:
Suite: Security
php
The whole request payload ($request->all()) is mass-assigned to an Eloquent model. Only the model's $fillable / $guarded lists stop attackers from setting extra attributes.
Category: SECURITY · Engine rule severity: INFO
How to fix it
Pass $request->validated(), $request->safe()->only([...]) or $request->only([...]) instead of $request->all().
References
Source: packages/engine/rules/sast/php.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.