This rule is deprecated; use {rule:javasecurity:S6173} instead.

## Why is this an issue?

Dynamically loaded classes could contain malicious code executed by a static class initializer. I.E. you wouldn’t even have to instantiate or explicitly invoke methods on such classes to be vulnerable to an attack.

This rule raises an issue for each use of dynamic class loading.

### Noncompliant code example

    String className = System.getProperty("messageClassName");
    Class clazz = Class.forName(className);  // Noncompliant

## Resources

- OWASP - Top 10 2017 Category A1 - Injection
- CWE - CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')