Uploaded image for project: 'SonarJava'
  1. SonarJava
  2. SONARJAVA-3151

S4684 should not raise issue when entity arg is annotated with @PathVariable

    Details

    • Type: False-Positive
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 5.14
    • Component/s: Rules
    • Labels:
      None

      Description

       

      import javax.persistence.Entity;
      
      @Entity
      public class Wish {
        Long productId;
        Long quantity;
        Client client;
      }
      
      
      import org.springframework.stereotype.Controller;
      import org.springframework.web.bind.annotation.PathVariable;
      import org.springframework.web.bind.annotation.RequestMapping;
      
      @Controller
      public class WishListController {  
      
      @PostMapping(path = "/saveForLater/{id}")
        public String saveForLater(@PathVariable("id") Wish wish) { // false positive : lookup will be done via id, object cannot be forged on client side.
          session.save(wish);
        }
      
      } 

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                quentin.jaquier Quentin Jaquier
                Reporter:
                nicolas.peru Nicolas Peru
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Due:
                  Created:
                  Updated:
                  Resolved: