GBonga242271 (Community Member) asked a question.
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE ID 470)(Medium)
String className = name;
if (!name.startsWith("com."))
{
className = taskHandlerPackage + "." + name;
}
ICustomInquiryFilter obj = null;
try
{
final Class<?> filterClass = Class.forName(className); //veracode throwing error here
obj = (ICustomInquiryFilter) filterClass.newInstance();
}
catch (final ClassNotFoundException e)
{
logErrorMsg("error.inquiryRequestFilter.classfile", null, className);
}
If any one knows remediation .please help
.png){kind=logo}
Hi @GBonga242271 (Community Member) ,
Veracode Static Analysis reports a flaw of CWE 470 when we can see that input from outside of the application (from a users HTTP request, but also from a file, database result or webservice call) is used in the name of a class that is to be loaded.
The only way Veracode Static Analysis will stop reporting this issue (close the flaw) is if we can see that the input no longer originates from outside of the application. That's why we typically recommend maintaining an allowlist and using the hardcoded allowlist value. You can find more information on this approach here: https://community.veracode.com/s/article/allowlist-helps-fix-cwe .
Thank you,
Boy Baukema