DOL032.md

DOL032 — fields = 'all' in Meta

Default severity: warning · Applicability: unsafe · Category: forms

Detects fields = '__all__' (either quote style), the pattern used in ModelForm / ModelAdmin Meta. It auto-exposes every model field for writing — including fields added later, which enter the form without anyone reviewing the change. That is a standing mass-assignment risk: a future is_staff, price_override, or owner field becomes user-writable the day it is added. An explicit field list makes every exposed field a deliberate, reviewable decision. The finding is unsafe and has no QuickFix — expanding '__all__' to a concrete list requires the model definition, which is a manual audit.

Bad

class ProfileForm(forms.ModelForm):
    class Meta:
        model = Profile
        fields = "__all__"

Good

class ProfileForm(forms.ModelForm):
    class Meta:
        model = Profile
        fields = ["display_name", "bio", "avatar"]

Suppress

# django-orm-lens-disable-next-line DOL032

Or per-workspace in .vscode/settings.json: {"djangoOrmLens.rules": {"DOL032": "off"}}.