I started getting into java security and had a question I could not find an answer to.

Lets say we have a web application that uses the following code, and that the UserControlledString can be set to be whatever class we want:

SomeClass someClassObj = (SomeClass) ClassUtil.newInstance(UserControlledString);

Would it be possible to exploit this and cause harm? From what I can tell most likely not but I thought I'd ask.


I don't know what ClassUtil is, but for Class.newInstance:

  • Some classes self-register from their constructor. A terrible idea, but there you go. The instance will therefore persist even if it is not an instance of SomeClass.

  • Perhaps there really is a subtype of SomeClass hanging that is inappropriate.

  • The ClassLoader may perform relatively expensive network or file access, and may accrete memory that wont go away until the process is rebooted.

  • It opens up the attack surface through badly written ClassLoaders. Think of all the fun characters you could put in the string.

  • Could you elaborate more on the self registering class example? Thank you! – learn2live Feb 27 '17 at 14:46

It depends on what some class is and what you are doing with it. In an of itself, there is nothing inherently insecure about it.


It is possible to cause harm if SomeClass is a parent class and the UserControlledString is the child class

Take parent class Discount as an example. There are child classes MixAndMatchDiscount and QuantityDiscount.

Discount discountObj = (Discount) ClassUtil.newInstance(UserControlledDiscountString);

Users can modify the expected discount to another discount to get a better price in case they know your class name.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.