Fix Mass Assignment in Assistants Endpoints (#6128)

christopherholland-workday · christopherholland-workday · web-flow · commit 1cf247eab35c · 2026-04-06T20:27:47.000+08:00
Co-authored-by: christopherholland-workday &lt;christopher.holland+evisort@workday.com&gt;
diff --git a/packages/server/src/controllers/assistants/index.ts b/packages/server/src/controllers/assistants/index.ts
@@ -35,7 +35,6 @@ const createAssistant = async (req: Request, res: Response, next: NextFunction)
         const newAssistantCount = 1
         await checkUsageLimit('flows', subscriptionId, getRunningExpressApp().usageCacheManager, existingAssistantCount + newAssistantCount)
 
-        body.workspaceId = workspaceId
         const apiResponse = await assistantsService.createAssistant(body, orgId, workspaceId)
 
         return res.json(apiResponse)
diff --git a/packages/server/src/services/assistants/index.ts b/packages/server/src/services/assistants/index.ts
@@ -140,7 +140,8 @@ const createAssistant = async (requestBody: any, orgId: string, workspaceId: str
             throw new InternalFlowiseError(StatusCodes.INTERNAL_SERVER_ERROR, `Error creating new assistant - ${getErrorMessage(error)}`)
         }
         const newAssistant = new Assistant()
-        Object.assign(newAssistant, requestBody)
+        Object.assign(newAssistant, stripProtectedFields(requestBody))
+        newAssistant.workspaceId = workspaceId
 
         const assistant = appServer.AppDataSource.getRepository(Assistant).create(newAssistant)
         const dbResponse = await appServer.AppDataSource.getRepository(Assistant).save(assistant)

Original file line number	Diff line number	Diff line change
`@@ -140,7 +140,8 @@ const createAssistant = async (requestBody: any, orgId: string, workspaceId: str`
`140`	`140`	throw new InternalFlowiseError(StatusCodes.INTERNAL_SERVER_ERROR, `Error creating new assistant - ${getErrorMessage(error)}`)
`141`	`141`	`}`
`142`	`142`	`const newAssistant = new Assistant()`
`143`		`- Object.assign(newAssistant, requestBody)`
	`143`	`+ Object.assign(newAssistant, stripProtectedFields(requestBody))`
	`144`	`+ newAssistant.workspaceId = workspaceId`
`144`	`145`
`145`	`146`	`const assistant = appServer.AppDataSource.getRepository(Assistant).create(newAssistant)`
`146`	`147`	`const dbResponse = await appServer.AppDataSource.getRepository(Assistant).save(assistant)`