Skip to main content
Version: 6.14.0

Reflect

The Reflect rule protects against reflection injection, where untrusted input is used to influence which class, method, or field is dynamically resolved and invoked through the Java Reflection API.

Overview​

Reflection lets code inspect and interact with classes, methods, and fields at runtime instead of compile time. When an application uses untrusted, externally-controlled input, such as an HTTP parameter, to select which class to instantiate or which method to invoke, an attacker can supply unexpected values to execute arbitrary code, bypass security checks, or access unintended functionality (CWE-470: Use of Externally-Controlled Input to Select Classes or Code).

Rule Wizard Rule Options page for the Reflect rule

Rule Options​

Activate the rule on payloads from these sources​

At least one source must be selected. The rule only applies to reflection calls whose arguments are influenced by data originating from one of the selected sources.

  • HTTP sources (eg. Web browser) - Data received by the application from HTTP requests (e.g. from a web browser).
  • SQL databases - Data received by the application from a SQL database.
  • Deserialization APIs (eg. RMI, JMX, etc.) - Data received by the application via deserialization APIs (e.g. RMI, JMX, java.io.ObjectInputStream, etc.)

Action​

  • Detect - The Agent will detect the reflection injection attempt and generate a Security Event which will be viewable on the Security Events page in the Portal, but the Agent will take no further action.
  • Protect - In addition to the Detect actions, the RASP Java Agent will also actively prevent the attack from succeeding.

Only a single Reflect rule is allowed per policy.