JSON Injection fortify fix in java

Viewed 937

I am using the below code for sanitizing the JSON but still, I am getting the JSON injection while scanning from Fortify can you please help me out what is the problem or this is not an issue, maybe suppress. I have also looked out for the same question but those don't solve my problem . my problem is that I am sanitizing my JSON before converting it to java object but still I am getting JSON injection error in fortify

public String handleEventMessage(String jsonRequest) {
    MonerisPaymentDetailsObject paymentObject = null;
        if(null!=jsonRequest && jsonRequest.length()>0){
            try{
                paymentObject = mapper.readValue(JsonSanitizer.sanitize(jsonRequest), MonerisPaymentDetailsObject.class);
            }catch(Exception ex){
                logger.error("Error occured while converting MonerisPaymentDetailsObject json to Object :" , ex);
          }
            
      return "abc";
   } 

Fortify giving below description for this error

 1. Data enters a program from an untrusted source.
    
    In this case the data enters at readLine() in EPWFPaymentServicesServlet.java at line 49.
    
    
    2. The data is written to a JSON stream.
    
    In this case the JSON is written by readValue() in EPWFMonerisPaymentsServiceHandler.java at line 46.

EPWFPaymentServicesServlet.java code where data is entered

 @Override
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
    throws ServletException, IOException {
        CodeTimer timer = new CodeTimer("EPWFPaymentServicesServlet.doPost()", true);
       
        response.setContentType("text/xml");

        BufferedReader reader = new BufferedReader(new InputStreamReader(request.getInputStream()));
        StringBuffer requestBuffer = new StringBuffer(request.getContentLength());
        String line = null;
        while ((line = reader.readLine()) != null) {
            requestBuffer.append(line).append('\n');
        }
        
        // read the POST request contents
        String requestString = requestBuffer.toString();
        if (logger.isDebugEnabled()) {
            logger.debug("EPWF Payment Service POST Request: \n" + ((requestString == null) ? "Null" : requestString.substring(0, 9)));
         }   
        
        PaymentServiceHandlerComposit paySvcHandler = new PaymentServiceHandlerComposit();
        String responseString =paySvcHandler.handleEventMessage(requestString);//line no 49 where fortify is giving description for class where i am sanitizing  the data
        
        if (logger.isDebugEnabled()) {
            logger.debug("EPWF Payment Service POST Response: \n" + ((responseString == null) ? "Null" : requestString));
         }   
        response.getOutputStream().print(responseString);
        timer.stopAndLogTiming("");
    }
1 Answers

Given that you are using a new up-to-date version of jackson, there should be no need to pre-sanitise or alter your data at all before handing it off to jackson.

Jackson will only accept and parse valid JSON, as new exploits and vulnerabilities are discovered, the maintainers of Jackson fix and release new versions. and the best you can do is to keep up to date with these versions.

If the above conditions are met, you can safely suppress this error from fortify, the chance that there is a bug in your custom sanitizer is way higher than the chance of there being one in Jackson

Related