ARMR Reflect Rule

Overview

The ARMR reflect rule protects against injection via the Java Reflection API. These operations should never be controlled by external input.

When (Event)

To control access to the Java Reflection API, users should specify only the condition and action.

Given (Conditions)

input

This allows the user to specify the source of the untrusted data.

The following three sources are supported:

• http data introduced via HTTP/HTTPS requests

• database data introduced via JDBC connections

• deserialization data introduced via Java or XML deserialization

The rule will trigger if the source of the untrusted data matches that specified in the rule.

Input is a mandatory parameter, and it cannot be an empty list.

Then (Action)

There are two supported actions for the ARMR reflect rule: protect and detect.

protect	All attempts to perform insecure reflective operations are blocked. If configured, a log message is generated with details of the event.
detect	Monitoring mode: the application behaves as normal. If configured, a log message is generated with details of the event. A log message must be specified with this action.

As part of the action statement, the user may optionally specify the parameter stacktrace: "full". When this parameter is specified, the stacktrace of the location of the attempted exploit is included in the security log entry.

Examples

In the following example, we define an ARMR reflect rule that prevents insecure reflective operations from the most popular inputs.

app("reflect app"):
    requires(version: ARMR/2.13)
    reflect("block tainted reflections"):
        input(http, database, deserialization)
        protect(message: "tainted reflection blocked", severity: High)
    endreflect
endapp