Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’)
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-470: Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) |
| OWASP | A03:2021 - Injection |
| Confidence Level | Low |
| Impact Level | Low |
| Likelihood Level | Low |
Description#
The code uses user-supplied input to dynamically select methods or fields via reflect.MethodByName or reflect.FieldByName in Go. This allows external input to control which function or field is accessed at runtime, which is unsafe.
Impact#
An attacker could manipulate input to invoke unintended methods or access sensitive fields, potentially bypassing authentication or authorization checks. This can lead to unauthorized actions, data leaks, or unexpected application behavior.