title: Dynamic Code Evaluation: JNDI Reference Injection Logging unmarshalled object
body: <p>I have a code like below, unfortunately fortify scan reports a JNDI reference injection here. How could that happen for a unmarshalled java object?</p>
  <pre><code>var response = restTemplate.exchange(&quot;url&quot;, HttpMethod.GET, entity, String.class);
  var customModel = mapper.readValue(response.getBody(), CustomModel.class);
  log.debug(&quot;Response from provider, {}&quot;, customModel.toString());
  </code></pre>