DBaffour435534 (Community Member) asked a question.
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE ID 470)
Hi - I have addressed this issue for creating an app domain by reflection by adding a method that contains a whitelist of allowed. However, the scan engine still reports this as a flaw.
if (Sanitizer.SanitizeClassName(AssemblyName))
this.Domain = AppDomain.CreateDomain(this.AppName, evidence, setup);
Are you able to advise how to proceed or does this require mitigation?
With regards,
Dennis.
.png){kind=logo}
Hi @DBaffour435534 (Community Member) ,
Veracode Static Analysis reports a flaw of CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') when it can see that data from outside of the application (such as from an HTTP Request, but also from a file or database read) is going into a Reflection API.
The danger being that an attacker would be able to select arbitrary classes which may grant them the ability to modify program behaviour.
Veracode Static Analysis is will only automatically close the flaw if the input is fully hardcoded. For example like so:
public string ValidateClassName(string AssemblyName) {
if (AssemblyName.Equals("AllowedClassA") {
return "AllowedClassA"; // <-- hardcoded, not coming from outside of application
}
else if (AssemblyName.Equals("AllowedClassB")) {
return "AllowedClassB"; // <-- hardcoded, not coming from outside of application
}
throw new SecurityException("Unknown class provided", AssemblyName);
}
Note that something very similar will not close the flaw and will require proposing a mitigation ( https://help.veracode.com/r/improve_mitigation ) and having this reviewed by your security team:
public string ValidateClassName(string AssemblyName) {
if (AssemblyName.Equals("AllowedClassA") {
return AssemblyName; // <-- still coming from input, must be mitigated
}
else if (AssemblyName.Equals("AllowedClassB")) {
return AssemblyName; // <-- still coming from input, must be mitigated
}
throw new SecurityException("Unknown class provided", AssemblyName);
}
Thank you,
Boy Baukema