CRITICAL
Rule Definition
The application uses external input with reflection methods manipulating resources, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended behavior.
This may enable an attacker to access or modify otherwise protected system resources.
Remediation
Assume all input is malicious.
Avoid using inputs. If it is not possible, use an "accept known good" input validation strategy, i.e., use stringent white-lists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack.
Violation Code Sample
String ctl = request.getParameter("ctl");
MyClass.class.getResourceAsStream("/initialization/" + ctl);
Fixed Code Sample
String ctl = VALUE;
MyClass.class.getResourceAsStream("/initialization/" + VALUE);
Reference
CWE-99: Improper Control of Resource Identifiers ('Resource Injection')
https://cwe.mitre.org/data/definitions/99.html
Open Web Application Security Project (OWASP)
https://www.owasp.org/index.php/Top_10_2007
CISQ rule: ASCSM-CWE-99.
Related Technologies
Technical Criterion
CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
About CAST Appmarq
CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.