CWE-470 Unsafe Reflection

Coverage: 21 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 21 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged reflection or dynamic class/module loading that is influenced by untrusted input. Reflection is powerful, but if attackers can choose what gets loaded or invoked, they can often bypass intended restrictions.

Why it matters

Unsafe reflection can load unexpected classes or behaviors.

• Unexpected code paths: attackers trigger internal functionality not meant to be exposed.
• RCE risk in some stacks if reflection can load arbitrary classes/modules.
• Authorization bypass if "which handler to run" is client-controlled.

Safer examples

1) Replace reflection with allowlisted dispatch

handlers = {"create": create_user, "delete": delete_user}
handler = handlers.get(action)
if not handler:
    raise ValueError("Invalid action")
handler()

2) Don't build class/module names from user input

Map user input to known implementations instead.

3) Add authorization around dynamic dispatch

Even with allowlists, ensure the selected action is authorized for the caller.

How SiteShadow detects it (high level)

• Detects reflection/dynamic import APIs and tracks whether the target name comes from untrusted input.
• Flags patterns where user input selects a class/method/module without allowlisting.

References

• CWE-470: https://cwe.mitre.org/data/definitions/470.html

---

← Back to Vulnerability Library