CWE-470 (使用外部可控制的输入来选择类或代码(不安全的反射)) — Vulnerability Class 35

CWE-470 represents a critical input validation weakness where applications utilize reflection to dynamically select classes or methods based on externally controlled data without adequate safeguards. Attackers typically exploit this vulnerability by injecting malicious payloads that reference unintended or dangerous classes, potentially leading to remote code execution, denial of service, or unauthorized access to sensitive system resources. This occurs because the application blindly trusts user-supplied strings to determine program flow, bypassing standard security controls. To mitigate this risk, developers must implement strict allow-listing mechanisms that restrict reflection to a predefined set of safe, expected classes. Additionally, input sanitization and rigorous validation should be applied to ensure that only authorized identifiers are processed, effectively neutralizing the threat of arbitrary code execution through unsafe reflection.