From cb30409b874cbec264b1578bd5f1b0c55dc1ab20 Mon Sep 17 00:00:00 2001 From: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com> Date: Mon, 5 Oct 2026 12:59:26 -0400 Subject: [PATCH] Reject unexpected request fields in Security Architect input validation Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com> --- security/security-architect.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/security/security-architect.md b/security/security-architect.md index b0c504f5..63dfd967 100644 --- a/security/security-architect.md +++ b/security/security-architect.md @@ -124,7 +124,7 @@ When reviewing any system, always ask: from fastapi import FastAPI, Depends, HTTPException, status, Request from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials -from pydantic import BaseModel, Field, field_validator +from pydantic import BaseModel, ConfigDict, Field, field_validator from slowapi import Limiter from slowapi.util import get_remote_address import re @@ -136,6 +136,7 @@ limiter = Limiter(key_func=get_remote_address) class UserInput(BaseModel): """Strict input validation — reject anything unexpected.""" + model_config = ConfigDict(extra="forbid") username: str = Field(..., min_length=3, max_length=30) email: str = Field(..., max_length=254)