VNX-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Field	Value
Rule ID	VNX-470
Severity	High
SARIF level	error
Kind	sast
Languages	Java, Python, Ruby
CWE	CWE-470
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:H/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:H/DI:H/EX:H/EC:N/P:H
Tags	unsafe-reflection cwe-470
Source	internal/sast/rules/vnx-470.rego

Overview

VNX-470 maps to CWE-470: Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’). Reports request data that chooses the class, module, method or constant reflection loads or calls: Java Class.forName, loadClass and getMethod/getField; Python import_module, import, getattr, pydoc.locate and globals()[…]; Ruby constantize, const_get and send/public_send. Constant names, configuration values, request.method, allow-listed values and fixed-table lookups are not reported.

Why This Matters

This weakness class (Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’)) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-470 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.

What Gets Flagged

// FLAGGED: a request parameter names the class
String handlerName = request.getParameter("handler");
Class<?> handlerClass = Class.forName(handlerName);

# FLAGGED: the query string picks the module to import
mod = importlib.import_module(request.args.get("plugin"))

# NOT FLAGGED: the input only selects from a fixed table
return importlib.import_module(PLUGINS[fmt]).export()

# FLAGGED: the type parameter becomes a class
exporter = params[:type].constantize.new(current_user)

# NOT FLAGGED: checked against an allow-list first
raise ActionController::BadRequest unless ALLOWED.include?(params[:type])

Remediation

1. Review each flagged line and determine whether the pattern represents a real instance of CWE-470 or a false positive.
2. Replace the flagged construct with a documented safe alternative appropriate to your language and framework.
3. For confirmed false positives, add a # vulnetix-ignore: VNX-470 comment on the line.
4. Ensure equivalent test coverage exists to prevent regression.

References

• CWE-470: Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’)
• OWASP Top 10

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-470
// nosec vnx-470

Or record an ignore rule: vulnetix ignore add --rule vnx-470 --reason "...". See Suppressing findings.