Odtnhj

I am getting Mass Assignment: Insecure Binder Configuration in fortify analysis.

Here is the AuthorisationController.class

@Controller
public class AuthorisationController 

 @RequestMapping(value = "/authorisation_request", method = RequestMethod.POST,
 produces = MediaType.APPLICATION_JSON_VALUE)
 @ResponseBody
 public ResponseEntity<AuthorisationRequest> createAuthorisation(HttpServletRequest request,
 @RequestBody AuthorisationRequestInfo createAuthorisation) 
 //processing code
 

Here is the AuthorisationRequestInfo.class on which the http request params will be mapped.

import com.fasterxml.jackson.annotation.JsonProperty;

public class OrderAuthorisationRequestInfo 


private String hashValue;
private String expiryDateTime;
private Integer initiatingRolePlayerId;

@JsonProperty("feedbackURI")
private String feedbackUri;

/**
 * Gets the hash value.
 *
 * @return the hash value
 */
public String getHashValue() 
 return hashValue;


/**
 * Sets the hash value.
 *
 * @param hashValue the new hash value
 */
public void setHashValue(String hashValue) 
 this.hashValue = hashValue;


/**
 * Gets the expiry date time.
 *
 * @return the expiry date time
 */
public String getExpiryDateTime() 
 return expiryDateTime;


/**
 * Sets the expiry date time.
 *
 * @param expiryDateTime the new expiry date time
 */
public void setExpiryDateTime(String expiryDateTime) 
 this.expiryDateTime = expiryDateTime;


/**
 * Gets the initiating role player id.
 *
 * @return the initiating role player id
 */
public Integer getInitiatingRolePlayerId() 
 return initiatingRolePlayerId;


/**
 * Sets the initiating role player id.
 *
 * @param initiatingRolePlayerId the new initiating role player id
 */
public void setInitiatingRolePlayerId(Integer initiatingRolePlayerId) 
 this.initiatingRolePlayerId = initiatingRolePlayerId;


/**
 * Gets the feedback URI.
 *
 * @return the feedback URI
 */
public String getFeedbackUri() 
 return feedbackUri;


/**
 * Sets the feedback URI.
 *
 * @param feedbackUri the new feedback URI
 */
public void setFeedbackUri(String feedbackUri) 
 this.feedbackUri = feedbackUri;

The interesting thing is that I only started getting this error after adding the @JsonProperty("feedbackURI") annotation on the feedbackUri column.

@InitBinder was not being used before and there was no fortify error and all the parameters in the request are mandatory.

All other APIs are fine and do not report any fortify issues. Only this api and another one in which the @JsonProperty was added have started showing this error.

Any help would be appreciated.