Abhishek M (Community Member) asked a question.
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE ID 470)(Medium)
I have a list of classes maintained in a property file which is hosted securely on the server, I can see that this CWE 470 will be reported isthe classes are coming from an external file, but here the external file is my own property file which cannot be altered in realtime , should i need to again add a white list functionality here, the file on server itself acts as a white list . Can i go ahead and mark as false positive ? or should i again need to add a white list?
.png){kind=logo}
Hello @Abhishek M (Community Member),
Thanks for your question. If you are certain the potential for reflection comes only from the hard-coded class names in this controlled property file, then it sounds like the correct next step would be to mark it as Mitigated By Design and capture the security controls around access to this file, e.g. "an attacker would need to be on the host" etc. Here is an article on filling out the mitigation form: https://docs.veracode.com/r/Propose_Mitigating_Factors_for_a_Flaw. If you are not certain then be sure to take a look at the Data Path on the Triage Flaws page. Sometimes there can be a DB call that is concatenated in which could cause this to surface.
I hope that answers your question.
Thanks,
Anthony Fielding