Rule Definition
The software constructs all or part of a dynamic evaluation using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended code when it is sent to a downstream component. This could allow attackers to access or execute unexpected, dangerous commands directly on the operating system. The application uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Remediation
Assume all input is malicious. Avoid using inputs. If it is not possible, use an "accept known good" input validation strategy, i.e., use stringent white-lists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack.

Violation Code Sample

String ctl; // value given by an API request
...
Class cmdClass = Class.forName(ctl + "Command");
Worker ao = (Worker) cmdClass.newInstance();
ao.doAction(request);

Fixed Code Sample

String ctl; // constant value
Class cmdClass = Class.forName(ctl + command);
Worker ao = (Worker) cmdClass.newInstance();
ao.doAction(request);

CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') https://cwe.mitre.org/data/definitions/470.html Open Web Application Security Project (OWASP) https://www.owasp.org/index.php/Unsafe_use_of_Reflection https://www.owasp.org/index.php/Top_10-2017_A1-Injection CISQ: ASCSM-CWE-470