eclipse-ee4j / eclipse-ee4j/jersey
Mass Assignment: Insecure Binder Configuration error during File Upload using @FormDataParam
- Dominant language
- Java
- Stars
- 730
- Forks
- 382
- PR merge metrics
- No merged PRs in 30d
Description
Hi All,
I have a requirement for uploading a file, I am using the Jersey Rest API as shown below. During security scans, it is giving the exception **Mass Assignment: Insecure Binder Configuration**
I am looking for a fix.
**Code Sample:**
import org.glassfish.jersey.media.multipart.FormDataContentDisposition;
import org.glassfish.jersey.media.multipart.FormDataParam;
@eclipsewebmaster ath("/XXX")
@Consumes(MediaType.MULTIPART_FORM_DATA)
@Produces("application/json")
public Response uploadFile( @Context HttpServletRequest request,
@FormDataParam("file" ) InputStream fileInputStream,
@FormDataParam("file") FormDataContentDisposition contentDispositionHeader) {
}
Issue details:
The framework binder used for binding the HTTP request parameters to the model class has not been explicitly configured to allow, or disallow certain attributes.
To ease development and increase productivity, most modern frameworks allow an object to be
automatically instantiated and populated with the HTTP request parameters whose names match an attribute of the class to be bound. Automatic instantiation and population of objects speeds up development, but can lead to serious problems if implemented without caution. Any attribute in the bound classes, or nested classes, will be automatically bound to the HTTP request parameters. Therefore, malicious users will be able to assign a value to any attribute in bound or nested classes, even if they are not exposed to the client through web forms or API contracts.
Contributor guide
Assessment
This issue has not been assessed yet.