RedisTemplate leads to unsafe deserialization in Fortify's dynamic code evaluation

Question

In making spring redis data template, I use:

RedisTemplate<String, xxxDTO> template = new RedisTemplate<>();

Then I also set the deserializer to a custom one that white lists certain class in case of unsafe deserialization.

Fortify somehow still highlights:

new RedisTemplate<>();

as unsafe deserialization during the dynamic code evaluation, within the kingdom Input Validation and Representation.

How to make a RedisTemplate without being flagged?

Answer 1

I have faced the same issue and the Fortify scan report flagged this as 'Dynamic Code Evaluation: Unsafe Deserialization'. Adding the solution since I didn't get a proper solution on StackOverflow.

Initial Code

@Bean
public RedisTemplate redisTemplate() {
    RedisSerializer<String> stringSerializer = new StringRedisSerializer();

    RedisTemplate<?, ?> template = new RedisTemplate<>();
    template.setConnectionFactory(jedisConnectionFactory());
    template.setKeySerializer(stringSerializer);
    template.setValueSerializer(stringSerializer);
    template.afterPropertiesSet();

    return template;
}

The problem was happening due to this line RedisTemplate<?, ?> template = new RedisTemplate<>();

Now, using safe serializers are recommended and I have used Jackson2JsonRedisSerializer for serializing and deserializing objects. I was already using StringRedisSerializer for strings.

Additionally, I initialized RedisTemplate<String, Object>, thereby specifying the key and value types.

Solution

@Bean
public RedisTemplate<String, Object> redisTemplate() {
    RedisSerializer<String> stringSerializer = new StringRedisSerializer();
    Jackson2JsonRedisSerializer<Object> objectSerializer = new Jackson2JsonRedisSerializer<>(Object.class);

    RedisTemplate<String, Object> template = new RedisTemplate<>();
    template.setConnectionFactory(jedisConnectionFactory());
    template.setKeySerializer(stringSerializer);
    template.setValueSerializer(objectSerializer);

    template.setHashKeySerializer(stringSerializer);
    template.setHashValueSerializer(objectSerializer);

    template.setEnableDefaultSerializer(true);
    template.afterPropertiesSet();

    return template;
}

This resolved my Fortify issue.