← all rules
code/privilege-from-client-js
Privilege escalation: role/admin flag assigned from request input
What it detects
A role/privilege attribute (role, isAdmin, permissions, accessLevel) is set from `req.body`/`req.query`/`req.params`. The client can then promote itself. Authorization attributes must be derived server-side from the authenticated session, never from the request payload.
How it runs
Applied line-by-line on JS/TS and Python files (comments skipped). Flags input flowing into a trust decision — an ORM write, a privilege attribute, a charge amount, or a primary-key lookup — where an authorization/ownership check should exist. Conservative by design: confirm whether the check is present nearby.
Found a false positive or want this rule tuned? File an issue. You can also suppress per-repo via a .repoguardignore line.