- 필수 기능
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- 디지털 경험
- 소프트웨어 제공
- 보안
- 로그 관리
- 관리
- 인프라스트럭처
- ci
- containers
- csm
- ndm
- otel_guides
- overview
- slos
- synthetics
- tests
- 워크플로
ID: java-security/unsafe-reflection
Language: Java
Severity: Error
Category: Security
Using reflection with class names being manually generated is unsafe and can lead to code injection. The class name must be validated and the program should make sure no malicious class can be loaded at runtime.
class Test {
void test() {
String which = "org.owasp.benchmark.helpers." + props.getProperty("thing");
System.out.println("foo");
Class<?> thing = Class.forName(which);
Constructor<?> thingConstructor = thing.getConstructor();
}
}
class Test {
void test() {
String which = "org.owasp.benchmark.helpers.MyClass";
System.out.println("foo");
Class<?> thing = Class.forName(which);
Constructor<?> thingConstructor = thing.getConstructor();
}
}
|
|
For more information, please read the Code Analysis documentation
Identify code vulnerabilities directly in yourVS Code editor
Identify code vulnerabilities directly inJetBrains products