знаюSUBSCRIPTION_JSON из клиента, который я конвертирую в String, а затем устанавливаю в Model Object с помощью библиотеки gson. При запуске кода в системе безопасности Fortify выдается ошибка Json-инъекции в приведенном ниже коде со следующим сообщением:

Вот ошибка:

On line 159 of ActionHelper.java, the method jsonToObject() writes unvalidated input into JSON. This call could allow an attacker to inject arbitrary elements or attributes into the JSON entity.The method writes unvalidated input into JSON. This call could allow an attacker to inject arbitrary elements or attributes into the JSON entity.

Explanation
JSON injection occurs when:

1. Data enters a program from an untrusted source.

In this case the data enters at getString() in **SubscriptionAction.java** at line 355.


2. The data is written to a JSON stream.

In this case the JSON is written by fromJson() in **ActionHelper.java** at line 159.

SubscriptionAction.java

final String subscriptionJson = subscriptionForm.getString(SUBSCRIPTION_JSON);

ActionHelper.java

public static <T> T jsonToObject(final String jsonString, final Class<T> className) {
        T object = null;
        if (StringUtils.isNotBlank(jsonString)) {
            final Gson gson = (Gson) BeanLocator.getInstance().getBean(GSON);
            object = gson.fromJson(jsonString, className);
        }
        return object;
    }

SUBSCRIPTION_JSON ->

{
    "subscriptions": [{
        "attributeId": "1",
        "items": [{
            "strId": "ALL",
            "nodeType": "G"
        }, {
            "strId": "VO_ENTRY_TIMING_DELAY",
            "nodeType": "L"
        }, {
            "strId": "O_INVALID",
 ,           "nodeType": "L"
        }, {
            "strId": "O_LINE_INVALID",
            "nodeType": "L"
        }, {
            "strId": "V_INVALID",
            "nodeType": "L"
        }, {
            "strId": "V_ADDRESS_INVALID",
            "nodeType": "L"
        }]
    }, {
        "attributeId": "2001",
        "items": [{
            "strId": "OSTBU",
            "nodeType": "L"
        }]
    }]
}