Java 中的 JSON 注入强化修复

Question

我正在使用以下代码来清理 JSON，但仍然在从 Fortify 扫描时收到 JSON 注入，请您帮我看看是什么问题，或者这不是问题，也许可以抑制。我也寻找了同样的问题，但那些并不能解决我的问题。我的问题是我在将 JSON 转换为 java 对象之前对其进行了消毒，但在 fortify 中仍然出现 JSON 注入错误

public String handleEventMessage(String jsonRequest) {
    MonerisPaymentDetailsObject paymentObject = null;
        if(null!=jsonRequest && jsonRequest.length()>0){
            try{
                paymentObject = mapper.readValue(JsonSanitizer.sanitize(jsonRequest), MonerisPaymentDetailsObject.class);
            }catch(Exception ex){
                logger.error("Error occured while converting MonerisPaymentDetailsObject json to Object :" , ex);
          }
            
      return "abc";
   } 

Fortify 对此错误给出以下描述

 1. Data enters a program from an untrusted source.
    
    In this case the data enters at readLine() in EPWFPaymentServicesServlet.java at line 49.
    
    
    2. The data is written to a JSON stream.
    
    In this case the JSON is written by readValue() in EPWFMonerisPaymentsServiceHandler.java at line 46.

EPWFPaymentServicesServlet.java 输入数据的代码

 @Override
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
    throws ServletException, IOException {
        CodeTimer timer = new CodeTimer("EPWFPaymentServicesServlet.doPost()", true);
       
        response.setContentType("text/xml");

        BufferedReader reader = new BufferedReader(new InputStreamReader(request.getInputStream()));
        StringBuffer requestBuffer = new StringBuffer(request.getContentLength());
        String line = null;
        while ((line = reader.readLine()) != null) {
            requestBuffer.append(line).append('\n');
        }
        
        // read the POST request contents
        String requestString = requestBuffer.toString();
        if (logger.isDebugEnabled()) {
            logger.debug("EPWF Payment Service POST Request: \n" + ((requestString == null) ? "Null" : requestString.substring(0, 9)));
         }   
        
        PaymentServiceHandlerComposit paySvcHandler = new PaymentServiceHandlerComposit();
        String responseString =paySvcHandler.handleEventMessage(requestString);//line no 49 where fortify is giving description for class where i am sanitizing  the data
        
        if (logger.isDebugEnabled()) {
            logger.debug("EPWF Payment Service POST Response: \n" + ((responseString == null) ? "Null" : requestString));
         }   
        response.getOutputStream().print(responseString);
        timer.stopAndLogTiming("");
    }

Answer 1

鉴于您使用的是新的最新版本的jackson，因此在将数据交给 jackson 之前根本不需要预先清理或更改您的数据。

Jackson 只会接受和解析有效的 JSON，当发现新的漏洞和漏洞时，Jackson 的维护者会修复并发布新版本。您能做的就是及时更新这些版本。

如果满足上述条件，您可以安全地从 fortify 中抑制此错误，您的自定义消毒剂中存在错误的可能性远远高于 Jackson 中存在错误的可能性