Description

Detects unsafe usage of Dart reflection (dart:mirrors) where user-controlled input can be used in dynamic code execution. This can lead to code injection vulnerabilities when untrusted data is used to dynamically invoke methods or create new instances through reflection.

Detection Strategy

• Check if the code imports the 'dart:mirrors' library

• Look for reflection method calls like invoke(), apply(), or newInstance()

• Verify if user-controlled input flows into the reflection method arguments

• Report a vulnerability when all conditions are met - both reflection usage and user input in reflection arguments

Vulnerable code example

import 'dart:mirrors';

class Admin {
  Admin() {
    print('admin');
  }
}
...

✅ Secure code example

import 'dart:mirrors';

class Admin {
  Admin() {
    print('admin');
  }
}
...