...
Basing security checks on untrusted sources can result in the check being bypassed.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
SEC02-J | High | Probable | Medium | P12 | L1 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Coverity | 7.5 | UNSAFE_REFLECTION | Implemented | ||||||
| Parasoft Jtest |
| CERT.SEC02.TDRFL | Protect against Reflection injection |
Related Guidelines
Authentication Logic Error [XZO] | |
CWE-302, Authentication Bypass by Assumed-Immutable Data |
Android Implementation Details
The code examples using the java.security package are not applicable to Android, but the principle of the rule is applicable to Android apps.
Bibliography
...
...