Mass Assignment Hard: Nested Properties

• The server loops through nested arrays and writes them directly into the state object.
• Bracket notation matters here.
• The visible form only edits profile fields, but the server trusts any nested object keys it receives.

Nested object merging is a common mass-assignment source. Once the server recursively trusts client keys, permission or billing objects become attacker-controlled.