Zennoxa Shield
Rules / Java
SHIELD-JAVA-016

Unsafe Reflection via Class.forName with Variable

highJavaCWE-470CVSS 7.5

What it detects

Class.forName loading a class from a variable enables attacker-controlled class loading.

How to fix

Restrict loadable classes to an allowlist rather than instantiating from raw input.

Vulnerable — Shield flags thisPluginLoader.java
public class PluginLoader {
    // "type" arrives as ?exporter=<name> on the report-export endpoint
    public Object newExporter(String type) throws Exception {
        Class<?> clazz = Class.forName(type);
        return clazz.getDeclaredConstructor().newInstance();
    }
}
Fixed — scans cleanPluginLoader.java
import java.util.Map;

public class PluginLoader {
    private static final Map<String, Exporter> EXPORTERS = Map.of(
            "pdf", new PdfExporter(),
            "csv", new CsvExporter());

    public Exporter newExporter(String type) {
        Exporter exporter = EXPORTERS.get(type);
        if (exporter == null) throw new IllegalArgumentException("Unknown exporter: " + type);
        return exporter;
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JAVA-016, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JAVA-016: Unsafe Reflection via Class.forName with Variable — Zennoxa Shield