# `react-doctor/request-body-mass-assignment`

Request input spread without field allowlist

- **Category:** Security
- **Severity:** warn
- **Source:** oxlint-plugin-react-doctor
- **Framework:** global
- **Enabled when:** always

## Validation prompt

Use this to decide whether a fired diagnostic is real or a false positive.

Confirm the reported code matches Request input spread without field allowlist. Check the framework context and diagnostic message before suppressing it.

## Fix prompt

Use this once validation confirms the diagnostic is real.

Assign explicit, allowlisted fields (or validate with a strict schema and no `.passthrough()`) instead of spreading/merging request input. Otherwise the client can set ownership, role, or price columns (mass assignment) or pollute the prototype.