org.sonar.l10n.java.rules.java.S2658.html Maven / Gradle / Ivy

Go to download

Show more of this group Show more artifacts with this name
Show all versions of sonar-java-plugin Show documentation

Code Analyzer for Java

There is a newer version: 8.10.0.38194

This rule is deprecated; use {rule:javasecurity:S6173} instead.
Why is this an issue?
Dynamically loaded classes could contain malicious code executed by a static class initializer. I.E. you wouldn’t even have to instantiate or
explicitly invoke methods on such classes to be vulnerable to an attack.
This rule raises an issue for each use of dynamic class loading.
Noncompliant code example
String className = System.getProperty("messageClassName");
Class clazz = Class.forName(className);  // Noncompliant

Resources

   OWASP - Top 10 2017 Category A1 - Injection 
   CWE - CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe
  Reflection')