Avoid user-generated class names for reflection This product is not supported for your selected
Datadog site . (
).
이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.
이 규칙을 사용해 보세요 ID: java-security/unsafe-reflection
Language: Java
Severity: Error
Category: Security
CWE : 470
Description Using reflection with class names being manually generated is unsafe and can lead to code injection. The class name must be validated and the program should make sure no malicious class can be loaded at runtime.
Non-Compliant Code Examples class Test {
void test () {
String which = "org.owasp.benchmark.helpers." + props . getProperty ( "thing" );
System . out . println ( "foo" );
Class <?> thing = Class . forName ( which );
Constructor <?> thingConstructor = thing . getConstructor ();
}
}
Compliant Code Examples class Test {
void test () {
String which = "org.owasp.benchmark.helpers.MyClass" ;
System . out . println ( "foo" );
Class <?> thing = Class . forName ( which );
Constructor <?> thingConstructor = thing . getConstructor ();
}
}
원활한 통합. Datadog Code Security를 경험해 보세요
