Mass assignment protection in Laravel - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when mass assignment is used without protection?

Consider a Laravel model with no $fillable or $guarded properties defined. What will happen if you try to create a new model instance using mass assignment with request data?

Laravel

User::create($request->all());

A Only attributes defined in the database schema will be saved, others ignored silently.

B Laravel will throw a MassAssignmentException error preventing the creation.

C The model will be created with all attributes from the request, potentially including sensitive fields.

D The model will be created but all attributes will be set to null.

💡 Hint

Think about what happens if you don't specify which fields are allowed for mass assignment.

By default, Laravel sets $guarded = ['*'] if neither $fillable nor $guarded is explicitly defined on the model. This guards all attributes and throws a MassAssignmentException when attempting mass assignment.

📝 Syntax

intermediate

Which code correctly protects against mass assignment?

Given a Laravel model, which of the following correctly protects the model from mass assignment vulnerabilities?

Laravel

class Post extends Model {
    // protection here
}

A protected $guarded = [];

B protected $guarded = ['title', 'content'];

C protected $fillable = ['*'];

D protected $fillable = ['title', 'content'];

💡 Hint

Remember, $fillable defines allowed fields, $guarded defines disallowed fields.

Setting $fillable to an array of allowed fields explicitly permits only those fields for mass assignment, protecting the model.

🔧 Debug

advanced

Why does this mass assignment fail with MassAssignmentException?

Given this model and controller code, why does the mass assignment fail?

Laravel

class Product extends Model {
    protected $guarded = ['id'];
}

// In controller
Product::create(['id' => 5, 'name' => 'Book', 'price' => 10]);

A Because 'id' is guarded, but it is included in the create array, causing the exception.

B Because 'name' and 'price' are not in $fillable, mass assignment is blocked.

C Because $guarded should be empty to allow mass assignment.

D Because the model is missing a $fillable property, mass assignment always fails.

💡 Hint

Check which fields are guarded and what is being assigned.

The 'id' field is guarded, so including it in mass assignment causes Laravel to throw a MassAssignmentException.

❓ state_output

advanced

What is the value of $user->admin after mass assignment?

Given this User model and code, what will be the value of $user->admin after creation?

Laravel

class User extends Model {
    protected $fillable = ['name', 'email'];
}

$user = User::create(['name' => 'Alice', 'email' => '[e-mail]', 'admin' => true]);

A true

B false

C null

D Throws MassAssignmentException

💡 Hint

Check which fields are allowed in $fillable and what happens to others.

Since 'admin' is not in $fillable, it is ignored during mass assignment and remains null.

🧠 Conceptual

expert

Why is mass assignment protection important in Laravel?

Which of the following best explains why Laravel uses mass assignment protection?

A To prevent users from setting sensitive model attributes they should not control, avoiding security risks.

B To improve database query performance by limiting fields.

C To automatically validate user input before saving to the database.

D To allow mass assignment only for admin users.

💡 Hint

Think about what could happen if users could set any attribute freely.

Mass assignment protection prevents users from setting sensitive fields like 'is_admin' or 'balance' which could lead to security breaches.