thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

Unsafe Reflection

Using user-controlled input to choose which classes or methods an application loads or invokes via reflection.

Definition

If an attacker can name the class or method, they may instantiate unexpected objects or call dangerous functions. Mitigations include mapping input to an allowlist of permitted handlers rather than resolving names dynamically. Tracked as CWE-470.

Example

A request parameter 'action' is passed to Class.forName() to choose a handler class.

Exam tip

Map inputs to an allowlist instead of resolving class names from requests.

Related terms