title: Checkmarx - How to validate and sanitize HttpServletRequest .getInputStream to pass checkmarx scan
body: <p>Following are checkmarx issue details
  <strong>Unrestricted File Upload</strong></p>
  <p>Source Object  : req (Line No - 39)</p>
  <p>target Object  : getInputStream (Line No -41)</p>
  <pre><code>    public class JWTLoginFilter extends AbstractAuthenticationProcessingFilter
  {
  
      //...
  38 public Authentication attemptAuthentication(HttpServletRequest req, HttpServletResponse res)
  39            throws AuthenticationException, IOException, ServletException
  40    {
  41        Entitlements creds = new ObjectMapper().readValue(req.getInputStream(), Entitlements.class);
  
          return getAuthenticationManager().authenticate(
                  new UsernamePasswordAuthenticationToken(creds.getId(), &quot;&quot;, Collections.emptyList()));
      }
      //...
  }
  </code></pre>
  <p><strong>request</strong> objects get highlighted in checkmarx tool -</p>
  <p>How do I properly validate, filter, escape, and/or encode user-controllable input to pass a Checkmarx scan?</p>