Description

Detects insecure dynamic class loading patterns in Scala Play Framework applications where URLClassLoader is used with reflection capabilities. This combination can allow attackers to load and execute arbitrary classes remotely, potentially leading to remote code execution.

Detection Strategy

• Application code must import both java.net.URLClassLoader and play.api.mvc packages

• Checks for method calls or expressions that end with known dangerous reflection patterns

• Verifies the presence of URLClassLoader usage in the code context

• Confirms unsafe reflection operations are being performed with the loaded classes

• Reports a vulnerability when all these conditions are met in the same code context

Vulnerable code example

import java.net.URL
import java.net.URLClassLoader
import play.api.mvc._

class VulnerableController extends InjectedController {
    def addUrlVulnerable() = Action { request =>
        val loader = new URLClassLoader(Array())
        // Vulnerable: Directly using untrusted input from headers to load arbitrary URLs...

✅ Secure code example

import java.net.URL
import java.net.URLClassLoader
import play.api.mvc._
import java.nio.file.{Path, Paths}

class VulnerableController extends InjectedController {
    private val ALLOWED_CLASSPATH_DIR = "/opt/app/libs" // Restrict to specific directory
    ...