title: Fortify Scan: ASP.NET MVC Bad Practices: Optional Submodel With Required Property - But required property in SubModel is nullable
body: <p>Fortify scan reports an issue with below code</p>
  <pre><code>class MyModel {
      public string Name {get;set;}
      public int StudentId {get;set;}
      public MySubModel Class {get;set;}
  }
  
  class MySubModel {
      public string Title {get;set;}
      [Required]
      public int? Id {get;set;}
  }
  </code></pre>
  <p>Scan issue:</p>
  <blockquote>
  <p>The model class MyModel has a required property of which the type is an optional member of a parent model type and therefore may be susceptible to under-posting attacks.</p>
  </blockquote>
  <p>MySubmodel.Id is Required but it is also Nullable. Why should I mark Class property which is of type MySubModel as [Required]? My business requirement does not say that Class is required. It appears to me that Fortify is not considering the fact that Id is nullable and simply shows an issue. My argument is that this is an issue in Fortify. I have tried a False positive but reviewer tries to tell me that I have to mark [Required] in both places. We are retro fixing and it is bit difficult for me to add the [Required] attribute on the model because it might break things. Any help is appreciated. By the way, we are using 21.1.2 version of Fortify.</p>
  <p>Just want to add here another but related issue: <strong>ASP.NET MVC Bad Practices: Model With Required Non-Nullable Property</strong></p>
  <pre><code>public class RequiredModelTest
  {
      [Required]
      public string Name { get; set; }
      [Required]
      public DateTime DateOfBirth { get; set; }
      [Required]
      public int Age { get; set; }
  }
  </code></pre>
  <p>Above code results in</p>
  <blockquote>
  <p>The model class RequiredModelTest has a required non-nullable property and therefore may be susceptible to under-posting attacks.</p>
  </blockquote>
  <p>The recommendation is to mark DateOfBirth and Age as nullable to prevent the attack.</p>
  <p>So the real question is then when nullable is accepted here why not with a SubModel? That is why I think this a False positive or really a bug in Fortify. It just ignores the fact that the property in SubModel is a nullable one.</p>