KBireddy101901 (Community Member) asked a question.
Need help in fixing flaw CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection').
I see this flaw in many places in our code. I have seen somewhere in veracode community that if we hardcode the value of the assembly/class veracode doesn't show it as a flaw. But it is showing a flaw where we are trying load an assembly with hardcoded string.
Assembly asm = Assembly.Load($"W0095751_Proxy, Culture=neutral, Version={provider["Version"]}, PublicKeyToken={provider["PublicKeyToken"]}");
Can you help me in understanding why is this happening and if there is any way to fix this apart from mitigation?
.png){kind=logo}
The given code appears to have 2 interpolated variables:
I would recommend reviewing these tokens and either hardcoding them (which Veracode Static Analysis can automatically verify) or ensuring appropriate validation is in place (which requires a mitigation).
Thank you,
Boy Baukema