Checkmarx 扫描期间 Java 中 class.forname 的代码注入问题

Question

How to resolve this code injection issue for class.forname in Java. During checkmarx scan I am facing this code injection issue, below is the sample code snippet

StringBuffer xml = new StringBuffer

xml.append("<?xml version=\ "1.0\"encoding=\"utf-8\" ?>");

xml.append("<Response>");

try{
    String strpath = request.getParameter("myclass");

    If(strpath!= null){
        xml.append("<Message>"+strpath+"</Message>");

        Class cls = Class.forName(strpath);

        strpath = getLocation(cls);

        xml.append("<Path>"+strpath+"</Path>");
    }

}

catch(Exception err){

    strpath = err.getMessage();

}

Answer 1

对于Checkmarx，直接给字符串“strpath”赋值，无需对其进行圣化，使用前需要验证字符串“strpath”，Checkmarx不会看到任何代码注入