VNX-386: Symbolic Name not Mapping to Correct Object

A Java class is looked up with Class.forName() or ClassLoader.loadClass() by a name assembled at run time (concatenation, String.format, or request data) without an allow-list check.

Field	Value
Rule ID	`VNX-386`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java
CWE	CWE-386
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`symbolic-name` `cwe-386`
Source	`internal/sast/rules/vnx-386.rego`

Overview

VNX-386 maps to CWE-386: Symbolic Name not Mapping to Correct Object. It reports Class.forName() and ClassLoader.loadClass() whose class-name argument is built by concatenation or String.format/formatted with a variable part (also across a line break), or is a variable assigned in the 15 lines above from such an expression or from request data (getParameter, getHeader, getQueryString, getPathInfo, getCookies, readLine).

Not reported: literal class names, ALL_CAPS constants, X.class.getName(), concatenations of literals only, a lookup preceded in the 10 lines above by an allow-list check of the variable (ALLOWED.contains(kind), a validator, matches()), map-based registries of Class objects, comments and string literals. Request-supplied class names are also reported by VNX-470 (unsafe reflection).

Why This Matters

A class name built from data can resolve to a class other than the one intended: any class on the classpath whose name the input can spell, including ones with dangerous constructors or static initialisers.

What Gets Flagged

Class<?> c = Class.forName(BASE + kind + "Plugin");                        // FLAGGED
loader.loadClass(String.format("com.acme.codec.%sCodec", format));         // FLAGGED
String renderer = req.getParameter("renderer");
Object r = Class.forName(renderer).getDeclaredConstructor().newInstance(); // FLAGGED

Not flagged: Class.forName("org.postgresql.Driver"), Class.forName(DRIVER_CLASS), a lookup after if (!ALLOWED.contains(kind)) throw ....

Remediation

Map the input to a fixed set of Class objects (a Map<String, Class<?>> or an enum) instead of building a class name.
If a dynamic name is unavoidable, check it against an explicit allow-list before loading it.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-386
// nosec vnx-386

Or record an ignore rule: vulnetix ignore add --rule vnx-386 --reason "...". See Suppressing findings.