Description

Detects unsafe use of reflection APIs within Spring Controller classes in Kotlin applications. This vulnerability could allow attackers to execute arbitrary code by manipulating reflection calls that load or instantiate classes dynamically.

Detection Strategy

• Code must be in a class annotated with @Controller or @RestController from Spring Framework

• Identifies calls to reflection APIs like Class.forName(), ClassLoader.loadClass() or similar reflection methods

• Verifies the reflection call uses dynamic/external input rather than hardcoded class names

• Reports vulnerability only when reflection target class name comes from an untrusted source

Vulnerable code example

@RestController
class UnsafeController {
    @GetMapping("/unsafe")
    fun loadClass(@RequestParam("class") className: String): String {
        // VULNERABLE: Unsafely loading arbitrary class from user input
        val cls = Class.forName(className)
        val instance = cls.getDeclaredConstructor().newInstance()
        return "Loaded: ${instance::class.java.name}"...

✅ Secure code example

@RestController
class SafeController {
    @GetMapping("/safe")
    fun loadClass(@RequestParam("class") className: String): String {
        // SECURE: Strict whitelist of allowed classes
        val allowedClasses = setOf(
            "com.example.SafeClassA",
            "com.example.SafeClassB"...