0

guys!

I've generated an application using JHipster v7.9.3. However, when this app was evaluated by my SonarQube server, it failed. One of the most common critical issues is the: RSPEC-4684 Persistent entities should not be used as arguments of "@RequestMapping" methods. This rule states the following:

On one side, Spring MVC automatically bind request parameters to beans declared as arguments of methods annotated with @RequestMapping. Because of this automatic binding feature, it's possible to feed some unexpected fields on the arguments of the @RequestMapping annotated methods.

On the other end, persistent objects (@Entity or @Document) are linked to the underlying database and updated automatically by a persistence framework, such as Hibernate, JPA or Spring Data MongoDB.

These two facts combined together can lead to malicious attack: if a persistent object is used as an argument of a method annotated with @RequestMapping, it's possible from a specially crafted user input, to change the content of unexpected fields into the database.

This issue is related to CWE-915

Checking out JHipster docs, I found out this page clarifying that they really uses its domain objects (typically JPA entities) directly in its REST endpoints with the intention to make the code simpler.

I wonder if this rule is still valid or if it doesn't apply anymore for more recent Spring Boot versions (v2.7.*) and I could safely disable rule 4684 at my SonarQube.

The only reference to this rule is this one on Sonar's Jira and it is shown still as Active.

1
  • 1
    Rule is valid, this is why JHipster offers you the option to use DTOs. Feb 9 at 22:30

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.