Search code examples
securityjavabeansfortify

Bean Manipulation Fortify Static Scan vulnerability

Is there a recommended library to use to fix "Bean Manipulation" vulnerability related with org.apache.commons.beanutils.populate (bean, paramMap)? I tried to write some custom method to validate the paramMap, but that did not resolve the issue.

regards Sanjay

Solution

  • Below refactoring seems to have removed the vulnerability from fortify scan:

        for(Map.Entry<String, ?> entry : fields.entrySet()) {
      BeanUtils.setProperty(object, entry.getKey(), entry.getValue());
    }