Data binding
A framework feature that copies request parameters onto an object by property name, including nested property paths. Unless the bindable fields are restricted, a client can set properties the developer never meant to expose, which is mass assignment and, in Spring4Shell, reached the class loader.
- Defined in
- Spring Framework reference: Data binding
Covered in
Case study
Case study: Spring4Shell (CVE-2022-22965)
How Spring's data binding let request parameters reach the class loader on JDK 9 and later in 2022, why the denylist workaround leaked, and what it teaches about framework-level mass assignment.
Guide
Authorize functions and fields as well as objects
Prevent mass assignment, sensitive-field exposure and administrative actions that a valid object lookup alone cannot protect.
Practice: Mass assignment lab: Update only the fields users may edit · Local project: Secure a real HTTP API