title: Mass Assignment: Insecure Binder Configuration with Fortify Java 1.8 EJB
body: <p>I am trying to solve some vulnerabilities issues, and I have one that I couldn't solve it, I tried to add @Valid annotation in sync method but same error, this is the description from fortify:</p>
  <blockquote>
  <p>The framework binder used for binding the HTTP request parameters to
  the model class has not been explicitly configured to allow, or
  disallow certain attributes.</p>
  <p>To ease development and increase productivity, most modern frameworks
  allow an object to be automatically instantiated and populated with
  the HTTP request parameters whose names match an attribute of the
  class to be bound. Automatic instantiation and population of objects
  speeds up development, but can lead to serious problems if implemented
  without caution. Any attribute in the bound classes, or nested
  classes, will be automatically bound to the HTTP request parameters.
  Therefore, malicious users will be able to assign a value to any
  attribute in bound or nested classes, even if they are not exposed to
  the client through web forms or API contracts.</p>
  </blockquote>
  <p>The error I am getting in this line:</p>
  <blockquote>
  <p>public ResponseClass sync(@BeanParam MyClassRequest request) throws
  Exception {</p>
  </blockquote>
  <p>MyClassResource.java</p>
  <pre><code>@Api(tags = &quot;Relay&quot;)
  @Stateless
  public class MyClassResource extends AbstractService&lt;MyClassRequest, ResponseClass&gt; {
   
      @EJB
      private MyClassService myClassService;
  
      @POST
      @Path(&quot;/api/v1/service&quot;)
      @Produces({&quot;application/json&quot;})
      @ApiOperation(value = &quot;Processes Conn&quot;,
              response = ResponseClass.class, responseContainer = &quot;ResponseClass&quot;, hidden = true)
      @Override
      public ResponseClass sync(@BeanParam MyClassRequest request) throws Exception {
          myClassService.processFeed(request);
          return new RelayResponse(HttpStatuses.ACCEPTED.getStatus());
      }
  </code></pre>
  <p>MyClassRequest.java</p>
  <p>In this file I have tried @FormParam(&quot;ccc&quot;) but same</p>
  <pre><code>public class MyClassRequest extends RelayRequest {
  
      public MyClassRequest() {
          super.setMessageType(&quot;not required&quot;);
      }
  
      private String myData;
      private String conneRid;
      private String connectionCreatedDate;
  </code></pre>
  <p>If someone could give some hint that how I can solve it, I will really appreciate it.</p>