A user updates their profile via PATCH /users/123 with { name: 'John', role: 'admin' }. If your code does `user.update(req.body)`, what's the vulnerability?

1. A The application is vulnerable to 'Mass Assignment', allowing a malicious user to modify internal-only fields (like 'role') by including them in the JSON body of the request.
2. B The PATCH request will trigger a blind SQL injection vulnerability because the dynamic user.update() method does not use parameterized queries for the incoming key-value pairs.
3. C The code is susceptible to a Cross-Site Request Forgery (CSRF) attack, as the server-side logic does not validate the Origin or Referer headers for partial resource updates.
4. D The operation will result in a permanent data loss (Tombstone collision) because the application fails to fetch the current resource state before applying the incoming update delta.