codejump
MediumJavaScriptTypeScript

Mass Assignment — Never Trust a Client-Supplied Role

TypeScriptSecurityInput Validation

The registration handler below builds a new user record directly from the request body.

The bug: nothing stops a client from including an extra role: "admin" field in the JSON body — a registration request meant to create an ordinary customer silently creates an administrator instead.

Your task: fix solve(input) so the returned user's role is always 'customer', regardless of anything the caller sent in input.role.

Sample tests

Test #1Normal registration, no role sent
Input: [{"email":"alice@example.com"}]
Output: {"role":"customer","email":"alice@example.com"}
Test #2Attacker-supplied role is ignored
Input: [{"role":"admin","email":"hacker@evil.com"}]
Output: {"role":"customer","email":"hacker@evil.com"}
Test #3Explicitly-sent customer role still comes from the server, not the input
Input: [{"role":"customer","email":"bob@example.com"}]
Output: {"role":"customer","email":"bob@example.com"}
← All challenges