title: Fortify error on JSON Injection in Java
body: <p>I am getting <strong>SUBSCRIPTION_JSON</strong> from client which I am converting it to String and then setting it to Model Object using gson library. On running the code on Fortify security, It is giving me Json injection error on below code with following message :</p>
  
  <p><em>Here is the error :</em></p>
  
  <pre><code>On line 159 of ActionHelper.java, the method jsonToObject() writes unvalidated input into JSON. This call could allow an attacker to inject arbitrary elements or attributes into the JSON entity.The method writes unvalidated input into JSON. This call could allow an attacker to inject arbitrary elements or attributes into the JSON entity.
  
  Explanation
  JSON injection occurs when:
  
  1. Data enters a program from an untrusted source.
  
  In this case the data enters at getString() in **SubscriptionAction.java** at line 355.
  
  
  2. The data is written to a JSON stream.
  
  In this case the JSON is written by fromJson() in **ActionHelper.java** at line 159.
  </code></pre>
  
  <p><strong><em>SubscriptionAction.java</em></strong></p>
  
  <pre><code>final String subscriptionJson = subscriptionForm.getString(SUBSCRIPTION_JSON);
  </code></pre>
  
  <p><strong><em>ActionHelper.java</em></strong> </p>
  
  <pre><code>public static &lt;T&gt; T jsonToObject(final String jsonString, final Class&lt;T&gt; className) {
          T object = null;
          if (StringUtils.isNotBlank(jsonString)) {
              final Gson gson = (Gson) BeanLocator.getInstance().getBean(GSON);
              object = gson.fromJson(jsonString, className);
          }
          return object;
      }
  </code></pre>
  
  <p><strong><em>SUBSCRIPTION_JSON</em></strong> -> </p>
  
  <pre><code>{
      "subscriptions": [{
          "attributeId": "1",
          "items": [{
              "strId": "ALL",
              "nodeType": "G"
          }, {
              "strId": "VO_ENTRY_TIMING_DELAY",
              "nodeType": "L"
          }, {
              "strId": "O_INVALID",
              "nodeType": "L"
          }, {
              "strId": "O_LINE_INVALID",
              "nodeType": "L"
          }, {
              "strId": "V_INVALID",
              "nodeType": "L"
          }, {
              "strId": "V_ADDRESS_INVALID",
              "nodeType": "L"
          }]
      }, {
          "attributeId": "2001",
          "items": [{
              "strId": "OSTBU",
              "nodeType": "L"
          }]
      }]
  }
  </code></pre>