Description

Detects unsafe usage of C# reflection through Activator.CreateInstance where the type parameter is dynamically controlled. This can allow attackers to instantiate arbitrary types, potentially leading to remote code execution vulnerabilities.

Detection Strategy

• Code imports the System namespace

• Contains calls to Activator.CreateInstance method

• The type parameter passed to CreateInstance is derived from untrusted/dynamic input rather than a hardcoded type

• Reports vulnerability when all conditions are met, indicating potential unsafe dynamic object instantiation

Vulnerable code example

using System;
using Microsoft.AspNetCore.Mvc;

public class VulnerableController : Controller
{
    public IActionResult Process()
    {
        string typeName = HttpContext.Request.QueryString["type"]; // User-controlled input...

✅ Secure code example

using System;
using System.Linq;
using Microsoft.AspNetCore.Mvc;

public class SafeController : Controller
{
    private static readonly string[] ALLOWED_TYPES = {
        "MyApp.SafeType1",...