org.sonar.l10n.java.rules.squid.S2658.html Maven / Gradle / Ivy

Go to download

Show more of this group Show more artifacts with this name
Show all versions of java-checks Show documentation

There is a newer version: 8.6.0.37351


  Dynamically loaded classes could contain malicious code executed by a static class initializer.
  I.E. you wouldn't even have to instantiate or explicitly invoke methods on such classes to be vulnerable to an attack.


This rule raises an issue for each use of dynamic class loading.

Noncompliant Code Example
String className = System.getProperty("messageClassName");
Class clazz = Class.forName(className);  // Noncompliant


See

  MITRE, CWE-545 - Use of Dynamic Class Loading
  OWASP Top 10 2013 Category A1 - Injection