apifuzz 0.2.0__py3-none-any.whl

apifuzz/checks/injection.py

@@ -0,0 +1,289 @@
+"""Check: does caller input reach a database query without being kept separate from it?
+
+OWASP API8:2019 Injection. When an endpoint pastes a request value straight into a SQL (or
+NoSQL) query instead of passing it as a bound parameter, the value can change what the query
+does. A search box that builds `... LIKE '%<q>%'` by string formatting will, given a <q> that
+closes the quote, run logic the caller chose instead of the logic the developer wrote.
+
+This check DETECTS that flaw; it never uses it to read or change data. For each testable input it
+sends a small set of marker values and watches the response *shape*, not its contents:
+
+1. Error signal. One value carries a single quote (``<marker>'``). If the server answers with a
+   database error (a 5xx whose body names SQL / SQLite / MySQL / Postgres / Mongo syntax), the
+   quote reached a query engine without being escaped.
+2. Boolean differential. Two values are sent that, pasted into a string query, are always-true
+   vs. always-false (``<marker>' OR '1'='1' -- `` vs. ``<marker>' AND '1'='2' -- ``). If the
+   always-true value produces a different result from the always-false one, the input is steering
+   the query's logic rather than being treated as plain text.
+3. NoSQL operator (body fields only). Where a scalar is expected, an operator-shaped object
+   (``{"$ne": <marker>}``) is sent. If it is accepted and changes the result, the value is
+   reaching a document query as structure, not data.
+
+Each signal is confirmed on a second request before it is reported, so a one-off difference is
+never a finding. The markers are inert: the check counts how many rows come back, never reads
+their contents, and writes nothing.
+
+What is probed, and what is left alone:
+  * Query-string parameters on GET/HEAD endpoints.
+  * JSON body fields, but only on endpoints that read or authenticate (login / search / lookup /
+    query shaped). Create/update endpoints are never probed with a body, so this check cannot
+    create or change data; mass-assignment covers those instead.
+
+Severity: HIGH. A confirmed injection point is among the most serious API flaws.
+"""
+
+import re
+from collections.abc import Callable, Iterator
+
+from apifuzz.checks.base import NOT_TESTED, TESTED, Check, ScanContext, fill_path, sample_body
+from apifuzz.endpoint_model import Endpoint
+from apifuzz.finding import Finding, Severity
+from apifuzz.http_client import Exchange
+
+_MARKER = "apifuzz"  # a harmless base value no real record is expected to equal
+_MAX_FIELDS = 5  # parameters/fields probed per endpoint, to keep the request count small
+
+# Payloads appended to the marker. The trailing `-- ` comments out whatever the query puts after
+# the value (a closing quote, a `%`), so the injected clause stands on its own if it is pasted in.
+_QUOTE = _MARKER + "'"  # unbalanced quote: breaks a string literal and surfaces a parse error
+_TRUE = _MARKER + "' OR '1'='1' -- "  # always true when pasted into a '...' context
+_FALSE = _MARKER + "' AND '1'='2' -- "  # always false in the same context
+_OPERATOR = {"$ne": _MARKER}  # an object where a scalar is expected: the NoSQL tell
+
+# Statuses that mean the request was handled (so a baseline or a probe settles something). A 404
+# for a sample value, or a 5xx with no database signature, settles nothing on its own.
+_HANDLED = {200, 201, 202, 204, 400, 401, 403, 409, 422}
+
+# Words (in a path segment or the operation id) that mark an endpoint whose body is a query, not
+# new data: safe to probe with injection markers because nothing is created or changed.
+_BODY_WORDS = {
+    "login", "signin", "sign-in", "sign_in", "token", "authenticate", "auth", "session", "sessions",
+    "search", "find", "lookup", "query", "filter", "suggest", "autocomplete",
+}
+
+# Words that mark a database error leaking back to the caller (matched case-insensitively).
+_DB_ERROR = re.compile(
+    r"sql|sqlite|mysql|mariadb|postgres|psql|oracle|odbc|syntax error|unrecognized token|"
+    r"unterminated|unclosed quotation|near \"|operationalerror|programmingerror|mongo|bson",
+    re.IGNORECASE,
+)
+
+_PROBEABLE_TYPES = (None, "string", "integer", "number")  # text or numbers, or a type the spec omitted
+
+
+def _sample(param_type: str | None) -> str:
+    return "1" if param_type in ("integer", "number") else _MARKER
+
+
+def _result_size(exchange: Exchange) -> int | None:
+    """How many records the response carries, or None when it has no countable collection.
+
+    A JSON array is counted directly; a JSON object is searched for its longest list value (for
+    bodies shaped like ``{"results": [...]}``). Anything else returns None, and the caller then
+    compares only status codes, never body length, so a payload echoed into the body can't be
+    mistaken for a bigger result set.
+    """
+    import json
+
+    try:
+        body = json.loads(exchange.response.body)
+    except ValueError:
+        return None
+    if isinstance(body, list):
+        return len(body)
+    if isinstance(body, dict):
+        lists = [v for v in body.values() if isinstance(v, list)]
+        if lists:
+            return max(len(v) for v in lists)
+    return None
+
+
+def _is_db_error(exchange: Exchange) -> bool:
+    """True when the answer is a server error that names a database engine or a query parse error."""
+    return exchange.response.status_code >= 500 and bool(_DB_ERROR.search(exchange.response.body))
+
+
+def _handled(exchange: Exchange) -> bool:
+    return exchange.response.status_code in _HANDLED
+
+
+def _differs(a: Exchange, b: Exchange) -> bool:
+    """True when two answers differ in a way that implies query logic, not just payload text.
+
+    Preferred signal: a different number of records. Fallback: a different status code. Body
+    length is deliberately not used, because the payloads are different strings and an endpoint
+    that echoes its input would differ on length alone.
+    """
+    size_a, size_b = _result_size(a), _result_size(b)
+    if size_a is not None and size_b is not None:
+        return size_a != size_b
+    return a.response.status_code != b.response.status_code
+
+
+class Injection(Check):
+    id = "injection"
+    owasp = "API8:2019 Injection"
+    description = "Request values must not reach a database query unescaped (SQL/NoSQL injection; detection only)."
+
+    def run(self, endpoint: Endpoint, ctx: ScanContext) -> Iterator[Finding]:
+        headers = None
+        if endpoint.requires_auth:
+            headers = ctx.auth("a") or ctx.auth("b")
+            if not headers:
+                # Only record for endpoints this check would otherwise probe, so unrelated
+                # endpoints aren't labelled "needs a test account".
+                if self._query_targets(endpoint) or self._body_targets(endpoint):
+                    ctx.record(self.id, endpoint, NOT_TESTED, "needs a test account")
+                return
+
+        if endpoint.method in ("GET", "HEAD"):
+            yield from self._run_query(endpoint, ctx, headers)
+        elif endpoint.method in ("POST", "PUT", "PATCH"):
+            yield from self._run_body(endpoint, ctx, headers)
+
+    # --- query-string parameters ---------------------------------------------------------------
+
+    def _query_targets(self, endpoint: Endpoint) -> list:
+        if endpoint.method not in ("GET", "HEAD"):
+            return []
+        return [p for p in endpoint.parameters if p.location == "query" and p.type in _PROBEABLE_TYPES]
+
+    def _run_query(self, endpoint: Endpoint, ctx: ScanContext, headers) -> Iterator[Finding]:
+        targets = self._query_targets(endpoint)[:_MAX_FIELDS]
+        if not targets:
+            return
+        url = ctx.url(fill_path(endpoint))
+        base = {p.name: _sample(p.type) for p in endpoint.parameters if p.location == "query" and p.required}
+
+        tested = False
+        for param in targets:
+            def send(value: object, name: str = param.name) -> Exchange:
+                return ctx.client.request(endpoint.method, url, headers=headers, params={**base, name: value})
+
+            outcome = self._probe(endpoint, param.name, "query parameter", send, allow_nosql=False)
+            if outcome is _UNHANDLED:
+                ctx.record(self.id, endpoint, NOT_TESTED, f"a benign value for {param.name!r} was not handled, which settles nothing")
+                continue
+            tested = True
+            if outcome is not None:
+                yield outcome
+        if tested:
+            ctx.record(self.id, endpoint, TESTED)
+
+    # --- JSON body fields (read/auth endpoints only) -------------------------------------------
+
+    def _body_targets(self, endpoint: Endpoint) -> list:
+        if endpoint.method not in ("POST", "PUT", "PATCH") or not self._is_query_shaped(endpoint):
+            return []
+        return [f for f in endpoint.request_fields if f.type in _PROBEABLE_TYPES]
+
+    def _is_query_shaped(self, endpoint: Endpoint) -> bool:
+        words = {seg.lower() for seg in endpoint.path.split("/") if seg and "{" not in seg}
+        if endpoint.operation_id:
+            words |= {w.lower() for w in re.findall(r"[A-Za-z][a-z]+|[A-Z]+(?![a-z])", endpoint.operation_id)}
+        return bool(words & _BODY_WORDS)
+
+    def _run_body(self, endpoint: Endpoint, ctx: ScanContext, headers) -> Iterator[Finding]:
+        targets = self._body_targets(endpoint)[:_MAX_FIELDS]
+        if not targets:
+            return
+        url = ctx.url(fill_path(endpoint))
+        base = sample_body(endpoint, text=_MARKER)
+
+        tested = False
+        for field in targets:
+            def send(value: object, name: str = field.name) -> Exchange:
+                return ctx.client.request(endpoint.method, url, headers=headers, json={**base, name: value})
+
+            outcome = self._probe(endpoint, field.name, "body field", send, allow_nosql=True)
+            if outcome is _UNHANDLED:
+                ctx.record(self.id, endpoint, NOT_TESTED, f"a benign value for {field.name!r} was not handled, which settles nothing")
+                continue
+            tested = True
+            if outcome is not None:
+                yield outcome
+        if tested:
+            ctx.record(self.id, endpoint, TESTED)
+
+    # --- the shared decision logic -------------------------------------------------------------
+
+    def _probe(
+        self, endpoint: Endpoint, name: str, where: str, send: Callable[[object], Exchange], *, allow_nosql: bool
+    ) -> "Finding | object | None":
+        """Probe one input. Returns a Finding, None (clean), or _UNHANDLED (no usable baseline)."""
+        baseline = send(_MARKER)
+        if not _handled(baseline):
+            return _UNHANDLED
+
+        # 1) Error-based: an unbalanced quote that produces a database error, confirmed on a repeat.
+        quote = send(_QUOTE)
+        if _is_db_error(quote) and _is_db_error(send(_QUOTE)):
+            return self._finding(
+                endpoint, name, where, how="a database error",
+                detail=(
+                    f"Sending the {where} {name!r} as {_QUOTE!r} (a value with one extra quote) was answered "
+                    f"HTTP {quote.response.status_code} with a database error in the body, confirmed on a second "
+                    "request. The quote reached the query engine unescaped, so the value is placed into the query "
+                    "text rather than bound as a parameter."
+                ),
+                evidence=[baseline, quote],
+            )
+
+        # 2) Boolean differential: always-true vs. always-false, each confirmed on a repeat.
+        true1, false1 = send(_TRUE), send(_FALSE)
+        if _handled(true1) and _handled(false1) and _differs(true1, false1):
+            true2, false2 = send(_TRUE), send(_FALSE)
+            if _result_size(true2) == _result_size(true1) and _result_size(false2) == _result_size(false1) and _differs(true2, false2):
+                return self._finding(
+                    endpoint, name, where, how="a boolean differential",
+                    detail=(
+                        f"An always-true value for the {where} {name!r} ({_TRUE!r}) and an always-false value "
+                        f"({_FALSE!r}) were answered differently, and the difference repeated on a second pair of "
+                        "requests. A value treated as plain text would give the same answer both times; a different "
+                        "answer means the value is changing what the query selects."
+                    ),
+                    evidence=[true1, false1],
+                )
+
+        # 3) NoSQL operator object where a scalar is expected (body fields only).
+        if allow_nosql:
+            op1 = send(_OPERATOR)
+            if _handled(op1) and _differs(op1, baseline):
+                op2 = send(_OPERATOR)
+                if _result_size(op2) == _result_size(op1) and _differs(op2, baseline):
+                    return self._finding(
+                        endpoint, name, where, how="a NoSQL operator object",
+                        detail=(
+                            f"Sending the {where} {name!r} as the operator object {_OPERATOR!r}, where a plain value "
+                            "is expected, changed the response compared with a plain value, and the change repeated. "
+                            "The object is being interpreted as part of a document query rather than rejected as the "
+                            "wrong type, which is how NoSQL operator injection works."
+                        ),
+                        evidence=[baseline, op1],
+                    )
+        return None
+
+    def _finding(
+        self, endpoint: Endpoint, name: str, where: str, *, how: str, detail: str, evidence: list[Exchange]
+    ) -> Finding:
+        return Finding(
+            check=self.id,
+            owasp=self.owasp,
+            severity=Severity.HIGH,
+            title=f"{where.capitalize()} {name!r} reaches a database query unsafely (injection)",
+            endpoint=f"{endpoint.method} {endpoint.path}",
+            key=name,
+            detail=detail + f" This was detected by {how}; no data was read or changed.",
+            remediation=(
+                "Never build a query by pasting request values into its text. Use parameterized queries (bound "
+                "placeholders) or your data layer's query builder, so input is always sent as data, not as part of "
+                "the query. For NoSQL, reject operator-shaped objects where a scalar is expected, and validate the "
+                "type and range of every value. Do not return raw database errors to the caller."
+            ),
+            evidence=evidence,
+        )
+
+
+# Sentinel returned by _probe when a benign baseline value was not even handled, so there is
+# nothing to compare a probe against. Distinct from None (probed, clean).
+_UNHANDLED = object()

apifuzz/checks/mass_assignment.py

@@ -0,0 +1,283 @@
+"""Check: does an update endpoint save fields the caller should not be able to set?
+
+This is OWASP API3 (Broken Object Property Level Authorization), better known as mass
+assignment. The spec says PATCH /users/{id} takes `name` and `email`, but the code copies the
+whole request body onto the user record, so a caller who also sends `role` gets it saved.
+
+How the check works, on one of test account A's own objects:
+
+1. Read the object (GET on the same path). Its fields that the spec does NOT list as writable
+   are the candidates, e.g. `role`. If none of those sticks, a few common hidden names are
+   tried as well (`role`, `is_admin`, `verified`).
+2. Send the update with exactly one extra field set to a probe value, then read the object back.
+   One field per request keeps the result easy to understand.
+3. If the read-back shows the probe value, and a second read confirms it, the field is writable
+   when it should not be: a finding.
+4. Put the original value back, and read once more to make sure. The finding says whether that
+   worked.
+
+The probe proves the flaw without using it. A text field such as `role` is set to the marker
+"apifuzz-probe", never to "admin", so the test account gains nothing. A true/false field is
+flipped and a number is raised by one, both only until step 4 restores them.
+
+Left alone on purpose, because a change there could not be undone safely:
+  - ids, owner fields and timestamps (changing an owner would hand the object to someone else)
+  - passwords, tokens and other secrets
+
+Create endpoints (POST /orders) are probed only when the spec also has DELETE /orders/{id}, so
+every object the check creates can be removed again: one plain object to learn the fields, then
+one per extra field, each deleted straight after it is read. Without a DELETE the endpoint is
+listed as not tested, because the test data could not be cleaned up.
+
+Severity: CRITICAL for a field that controls what the user may do (role, is_admin, verified...),
+HIGH for any other field the spec doesn't list as writable.
+"""
+
+import json
+from collections.abc import Iterator
+
+from apifuzz.checks.base import NOT_TESTED, TESTED, Check, ScanContext, fill_path, sample_body
+from apifuzz.checks.bola import _as_id, own_id
+from apifuzz.endpoint_model import Endpoint
+from apifuzz.finding import Finding, Severity
+from apifuzz.http_client import Exchange
+
+PROBE_TEXT = "apifuzz-probe"  # the marker written into text fields
+_MAX_FIELDS = 6  # fields of the object tried per endpoint
+_MAX_CREATE_FIELDS = 3  # on create endpoints every try makes (and deletes) an object, so fewer
+_HIDDEN_GUESSES = ("role", "is_admin", "verified")  # tried only when no real field sticks
+_MISSING = object()  # "the object has no such field", as opposed to a field that is null
+
+# Field names (lower case, underscores removed) that decide what a user is allowed to do.
+_PRIVILEGE = {
+    "role", "roles", "admin", "isadmin", "isstaff", "superuser", "issuperuser", "permissions", "scope", "scopes",
+    "verified", "isverified", "emailverified", "active", "isactive", "plan", "tier", "group", "groups",
+}
+# Parts of a field name that mean "do not touch": identity, ownership, time stamps, secrets.
+_UNTOUCHABLE_PARTS = (
+    "owner", "user", "tenant", "account", "created", "updated", "modified", "deleted", "date",
+    "password", "passwd", "secret", "token", "key", "hash", "salt",
+)
+def _norm(name: str) -> str:
+    return name.lower().replace("_", "").replace("-", "")
+
+
+def _is_privilege(name: str) -> bool:
+    return _norm(name) in _PRIVILEGE
+
+
+def _probeable(name: str, value: object) -> bool:
+    """True if the field can be changed and put back safely (see the module docstring)."""
+    lower = name.lower()
+    if lower == "id" or lower.endswith("_id") or name.endswith("Id") or lower.endswith("_at"):
+        return False
+    if any(part in lower for part in _UNTOUCHABLE_PARTS):
+        return False
+    return value is None or isinstance(value, (str, bool, int, float))
+
+
+def _probe_value(original: object) -> object:
+    """A value that differs from the original, but grants as little as possible."""
+    if isinstance(original, bool):
+        return not original
+    if isinstance(original, (int, float)):
+        return original + 1
+    return PROBE_TEXT
+
+
+def _object(exchange: Exchange) -> dict | None:
+    if not exchange.response.ok:
+        return None
+    try:
+        body = json.loads(exchange.response.body)
+    except ValueError:
+        return None
+    return body if isinstance(body, dict) else None
+
+
+class MassAssignment(Check):
+    id = "mass-assignment"
+    owasp = "API3:2023 Broken Object Property Level Authorization"
+    description = "An update must not save fields the spec doesn't list as writable, such as role (needs one account)."
+
+    def run(self, endpoint: Endpoint, ctx: ScanContext) -> Iterator[Finding]:
+        if endpoint.method not in ("PATCH", "PUT", "POST") or not endpoint.requires_auth or not endpoint.request_fields:
+            return
+        headers = ctx.auth("a")
+        if not headers:
+            ctx.record(self.id, endpoint, NOT_TESTED, "needs a test account")
+            return
+        if endpoint.method == "POST":
+            yield from self._run_create(endpoint, ctx, headers)
+            return
+        path_params = [p for p in endpoint.parameters if p.location == "path"]
+        if len(path_params) > 1:
+            ctx.record(self.id, endpoint, NOT_TESTED, "has more than one path parameter (not supported yet)")
+            return
+        if not any(e.method == "GET" and e.path == endpoint.path for e in ctx.endpoints):
+            ctx.record(self.id, endpoint, NOT_TESTED, "has no GET on the same path to read the object back")
+            return
+
+        values: dict[str, str] = {}
+        if path_params:
+            param = path_params[0]
+            object_id = own_id(ctx, endpoint, param.name)
+            if object_id is None or (param.type in ("integer", "number") and not object_id.isdigit()):
+                ctx.record(self.id, endpoint, NOT_TESTED, "no object of the test account is known for it")
+                return
+            values[param.name] = object_id
+        url = ctx.url(fill_path(endpoint, values))
+
+        def read() -> dict | None:
+            return _object(ctx.client.request("GET", url, headers=headers))
+
+        before = read()
+        if before is None:
+            ctx.record(self.id, endpoint, NOT_TESTED, "the object could not be read before changing it")
+            return
+
+        declared = {f.name for f in endpoint.request_fields}
+        present = [k for k, v in before.items() if k not in declared and _probeable(k, v)]
+        present.sort(key=lambda k: not _is_privilege(k))  # privilege fields first (stable sort)
+        hidden = [n for n in _HIDDEN_GUESSES if n not in before and n not in declared]
+
+        found = False
+        ctx.record(self.id, endpoint, TESTED)
+        for field in [*present[:_MAX_FIELDS], *hidden]:
+            if found and field in hidden:
+                break  # a real field already stuck; guessing hidden names would only add noise
+            original = before.get(field, _MISSING)
+            probe = _probe_value(None if original is _MISSING else original)
+            # PATCH changes only what it is given; PUT replaces the object, so send it back whole.
+            body = {field: probe} if endpoint.method == "PATCH" else {**before, field: probe}
+            write = ctx.client.request(endpoint.method, url, headers=headers, json=body)
+            if not write.response.ok:
+                continue  # refused: what a correct API does with a field it doesn't accept
+            readback = ctx.client.request("GET", url, headers=headers)
+            after = _object(readback) or {}
+            if after.get(field, _MISSING) != probe:
+                continue  # accepted but not saved: the field was ignored
+            confirm = _object(ctx.client.request("GET", url, headers=headers)) or {}
+            confirmed = confirm.get(field, _MISSING) == probe
+
+            # Put things back the way they were, whether or not the result is reported.
+            restore_value = None if original is _MISSING else original
+            restore_body = {field: restore_value} if endpoint.method == "PATCH" else dict(before)
+            restore = ctx.client.request(endpoint.method, url, headers=headers, json=restore_body)
+            final = read() or {}
+            restored = final.get(field, _MISSING) == original or (original is _MISSING and final.get(field) is None)
+            if not confirmed:
+                continue  # not reproducible; don't report a flaky result
+
+            found = True
+            privilege = _is_privilege(field)
+            was = "did not exist" if original is _MISSING else f"was {json.dumps(original)}"
+            cleanup = (
+                "The original value was put back afterwards."
+                if restored
+                else f"The original value could NOT be put back: set {field!r} on this object by hand."
+            )
+            yield Finding(
+                check=self.id,
+                owasp=self.owasp,
+                severity=Severity.CRITICAL if privilege else Severity.HIGH,
+                title=f"Field {field!r} can be set by the caller (mass assignment)",
+                endpoint=f"{endpoint.method} {endpoint.path}",
+                key=field,
+                detail=(
+                    f"The spec does not list {field!r} as a writable field, but sending it in the update "
+                    f"saved it: it {was}, and the object read back showed {json.dumps(probe)} (confirmed "
+                    f"on a second read). "
+                    + ("This field controls what the user may do, so a caller can raise their own privileges. " if privilege else "")
+                    + cleanup
+                ),
+                remediation=(
+                    "Copy only the fields the endpoint is meant to accept from the request onto the object "
+                    "(an explicit allowlist or a dedicated input model), and ignore or reject everything else. "
+                    "Never bind the whole request body to the stored record."
+                ),
+                evidence=[write, readback, restore],
+            )
+
+    def _run_create(self, endpoint: Endpoint, ctx: ScanContext, headers: dict[str, str]) -> Iterator[Finding]:
+        """Mass assignment on a create endpoint. Every object created here is deleted again."""
+        if "{" in endpoint.path:
+            ctx.record(self.id, endpoint, NOT_TESTED, "is a create endpoint under a path parameter (not supported yet)")
+            return
+        base = endpoint.path.rstrip("/")
+        # The single-object path, e.g. "/orders/{id}": it must offer DELETE (cleanup) and GET (read-back).
+        item = [e for e in ctx.endpoints if e.path.startswith(base + "/{") and e.path.endswith("}") and e.path.count("{") == 1]
+        deleter = next((e for e in item if e.method == "DELETE"), None)
+        reader = next((e for e in item if e.method == "GET"), None)
+        if deleter is None or reader is None:
+            ctx.record(
+                self.id, endpoint, NOT_TESTED,
+                "has no DELETE and GET for the created object, so test data could not be cleaned up",
+            )
+            return
+        param = next(p.name for p in deleter.parameters if p.location == "path")
+        url = ctx.url(endpoint.path)
+        leftovers: list[str] = []
+
+        def create(extra: dict[str, object]) -> tuple[Exchange, dict | None, str | None]:
+            ex = ctx.client.request("POST", url, headers=headers, json={**sample_body(endpoint), **extra})
+            created = _object(ex)
+            return ex, created, _as_id((created or {}).get("id"))
+
+        def remove(object_id: str) -> Exchange:
+            ex = ctx.client.request("DELETE", ctx.url(fill_path(deleter, {param: object_id})), headers=headers)
+            if not ex.response.ok:
+                leftovers.append(object_id)
+            return ex
+
+        _, plain, plain_id = create({})
+        if plain is None or plain_id is None:
+            ctx.record(self.id, endpoint, NOT_TESTED, "a plain create did not answer with an object that has an id")
+            return
+        remove(plain_id)
+
+        declared = {f.name for f in endpoint.request_fields}
+        present = [k for k, v in plain.items() if k not in declared and _probeable(k, v)]
+        present.sort(key=lambda k: not _is_privilege(k))
+        hidden = [n for n in _HIDDEN_GUESSES if n not in plain and n not in declared]
+        ctx.record(self.id, endpoint, TESTED)
+        for field in [*present, *hidden][:_MAX_CREATE_FIELDS]:
+            original = plain.get(field, _MISSING)
+            probe = _probe_value(None if original is _MISSING else original)
+            write, _, object_id = create({field: probe})
+            if object_id is None:
+                continue  # refused, or no object came back: nothing was created to look at
+            readback = ctx.client.request("GET", ctx.url(fill_path(reader, {param: object_id})), headers=headers)
+            cleanup = remove(object_id)
+            if (_object(readback) or {}).get(field, _MISSING) != probe:
+                continue  # the extra field was ignored
+            privilege = _is_privilege(field)
+            was = "is not normally there" if original is _MISSING else f"is normally {json.dumps(original)}"
+            yield Finding(
+                check=self.id,
+                owasp=self.owasp,
+                severity=Severity.CRITICAL if privilege else Severity.HIGH,
+                title=f"Field {field!r} can be set by the caller on create (mass assignment)",
+                endpoint=f"{endpoint.method} {endpoint.path}",
+                key=field,
+                detail=(
+                    f"The spec does not list {field!r} as a field of the create request, but sending it "
+                    f"saved it: it {was}, and the new object read back showed {json.dumps(probe)}. "
+                    + ("This field controls what the user may do. " if privilege else "")
+                    + (
+                        "The object created for this test was deleted again."
+                        if cleanup.response.ok
+                        else f"The object created for this test (id {object_id}) could NOT be deleted: remove it by hand."
+                    )
+                ),
+                remediation=(
+                    "Build the new object only from the fields the endpoint is meant to accept (an explicit "
+                    "allowlist or a dedicated input model), and set everything else on the server."
+                ),
+                evidence=[write, readback, cleanup],
+            )
+        if leftovers:
+            notes = ctx.cache.setdefault("leftovers", [])
+            notes.append(  # type: ignore[attr-defined]
+                f"{endpoint.method} {endpoint.path}: test objects could not be deleted, ids {', '.join(leftovers)}"
+            )