I started getting into java security and had a question I could not find an answer to.
Lets say we have a web application that uses the following code, and that the UserControlledString can be set to be whatever class we want:
SomeClass someClassObj = (SomeClass) ClassUtil.newInstance(UserControlledString);
Would it be possible to exploit this and cause harm? From what I can tell most likely not but I thought I'd ask.