7

I have this Controller in Java:

@Controller
public class AuthenticationController extends AbstractController {

  @RequestMapping(value = Constantes.MAPPING_AUTH_BASE_ASP, method = { RequestMethod.POST })
  public String authenticate(@Valid ComunicationWithAspRequest comunicationWithAspRequest, BindingResult result,
      RedirectAttributes redirectAttributes, HttpSession sesion) throws Exception {
    ...
    ...
    ...
  }
}

When I scan my code in Fortify, the object comunicationWithAspRequest causes the Mass Assignment: Insecure Binder Configuration Vulnerability. Is possible to control which HTTP request parameters will be used in the binding process and which ones will be ignored?

2 Answers 2

9

You may refer to the problem Prevent mass assignment in Spring MVC with Roo.

In your case, you can use @InitBinder provided by Spring MVC. @InitBinder would specify the white list for json and bean mapping.

In my experience, I used @RequestBody for auto-binding. I need to add @JsonIgnore to specify the property that would not include for the mapping.

SimpleController.java

@RequestMapping(value="/simple")
public String simple(@Valid @RequestBody User user){
   simpleService.doSomething();
}

User.java

public class User{
   private String name;

   @JsonIgnore
   private String dummy;

   public void getName(){return name;}
   public void setName(name){this.name = name;}
   public void getDummy(){return dummy;}
   public void setDummy(dummy){this.dummy= dummy;}

}
9
  • I was searching solution for same fortify mass assignment issue, whitelisting and black listing is a tedious task for my application.Is there any other way to fix this other than spring @InitBinder ?
    – Shibina EC
    Jun 14, 2018 at 10:17
  • In my project, i just use a dirty way to solve this issue. ie. @JsonIgnore
    – Ben Cheng
    Jun 15, 2018 at 2:22
  • I tried JsonView which works for my project more than JsonIgnore since the objects are used for more than 1 endpoint. Yet Fortify doesn't seem to recognize it Jan 18, 2019 at 16:32
  • 1
    One more finding is that, Fortify is actually just to do scan to pop you warning. Some issue may not is solved, you just need to accept it with reason.
    – Ben Cheng
    Jan 19, 2019 at 7:25
  • In my project, I have used something like @JsonIgnoreProperties(ignoreUnknown=true) Jul 10, 2019 at 9:08
2

By adding @JsonIgnoreProperties(ignoreUnknown = true) annotation on the class level the issue can be resolve in case we don't know what to ignore.

@JsonIgnoreProperties(ignoreUnknown = true)
public class className{

}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.