title: Checkmarx: Unsafe object binding
body: <p>We are using Java Spring framework. We have an endpoint for passing email object.</p>
  <pre><code>    @RequestMapping(method = RequestMethod.POST, path = &quot;/api/messaging/v1/emailMessages/actions/send&quot;)
  String sendEmail(@RequestBody Email email);
  </code></pre>
  <p>Here checkmarx says: The <code>email</code> may unintentionally allow setting the value of <code>cc</code> in <code>LinkedList&lt;&gt;</code>, in the object <code>Email</code>.</p>
  <p>Email Object is as follow:</p>
  <pre><code>public class Email {
  
  private List&lt;String&gt; bcc = new LinkedList&lt;&gt;();
  
  private List&lt;String&gt; cc = new LinkedList&lt;&gt;();
  
  private String content;
  
  private ContentType contentType = ContentType.TXT;
  
  private String from;
  
  private String returnPath;
  
  private Date sent;
  
  private String subject;
  
  private List&lt;EmailAttachment&gt; attachments = new LinkedList&lt;&gt;();
  
  private List&lt;String&gt; to = new LinkedList&lt;&gt;();
  
  public List&lt;String&gt; getBcc() {
      return bcc;
  }
  
  public void setBcc(String bcc) {
      this.bcc = Collections.singletonList(bcc);
  }
  
  public void setBcc(List&lt;String&gt; bcc) {
      this.bcc = bcc;
  }
  
  public List&lt;String&gt; getCc() {
      return cc;
  }
  
  public void setCc(String cc) {
      this.cc = Collections.singletonList(cc);
  }
  
  public void setCc(List&lt;String&gt; cc) {
      this.cc = cc;
  }
  
  public String getContent() {
      return content;
  }
  
  public void setContent(String content) {
      this.content = content;
  }
  
  public ContentType getContentType() {
      return contentType;
  }
  
  public void setContentType(ContentType contentType) {
      this.contentType = contentType;
  }
  
  public String getFrom() {
      return from;
  }
  
  public void setFrom(String from) {
      this.from = from;
  }
  
  public String getReturnPath() {
      return returnPath;
  }
  
  public void setReturnPath(String returnPath) {
      this.returnPath = returnPath;
  }
  
  public Date getSent() {
      return sent;
  }
  
  public void setSent(Date sent) {
      this.sent = sent;
  }
  
  public String getSubject() {
      return subject;
  }
  
  public void setSubject(String subject) {
      this.subject = subject;
  }
  
  public List&lt;String&gt; getTo() {
      return to;
  }
  
  public void setTo(String to) {
      this.to = Collections.singletonList(to);
  }
  
  public void setTo(List&lt;String&gt; to) {
      this.to = to;
  }
  
  public List&lt;EmailAttachment&gt; getAttachments() {
      return attachments;
  }
  
  public void setAttachments(List&lt;EmailAttachment&gt; attachments) {
      this.attachments = attachments;
  }
  
  public boolean equals(Object object) {
      boolean equals = false;
      if (object instanceof Email) {
          Email that = (Email) object;
          equals = Objects.equal(this.from, that.from)
                  &amp;&amp; Objects.equal(this.to, that.to)
                  &amp;&amp; Objects.equal(this.subject, that.subject)
                  &amp;&amp; Objects.equal(this.content, that.content);
      }
  
      return equals;
  }
  </code></pre>
  <p>}</p>
  <p>I don't understand these findings, how to solve this.</p>