{"record":{"id":"0467037fb1d22bd1","repo":"Activiti/Activiti","slug":"illegal-use-of-reflection-in-a-juel-expression","errorCode":null,"errorMessage":"Illegal use of Reflection in a JUEL Expression","messagePattern":"Illegal use of Reflection in a JUEL Expression","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"activiti-core-common/activiti-expression-language/src/main/java/org/activiti/core/el/ELResolverReflectionBlockerDecorator.java","lineNumber":48,"sourceCode":"public class ELResolverReflectionBlockerDecorator extends ELResolverDecorator {\n\n    private static final String JAVA_REFLECTION_PACKAGE = \"java.lang.reflect\";\n    private static final Predicate<Method> IS_FINAL = method -> Modifier.isFinal(method.getModifiers());\n    private static final Predicate<Method> IS_NATIVE = method -> Modifier.isNative(method.getModifiers());\n    private static final Set<String> NATIVE_METHODS = Arrays.stream(Object.class.getMethods())\n        .filter(IS_FINAL.or(IS_NATIVE))\n        .map(Method::getName)\n        .collect(Collectors.toSet());\n\n    public ELResolverReflectionBlockerDecorator(ELResolver resolver) {\n        super(resolver);\n    }\n\n    @Override\n    public Object invoke(ELContext context, Object base, Object method, Class<?>[] paramTypes, Object[] params) {\n        final String basePackageName = base.getClass().getPackageName();\n        if (JAVA_REFLECTION_PACKAGE.equals(basePackageName)) {\n            throw new IllegalArgumentException(\"Illegal use of Reflection in a JUEL Expression\");\n        }\n\n        if (NATIVE_METHODS.contains(method)) {\n            throw new IllegalArgumentException(\"Illegal use of Native Method in a JUEL Expression\");\n        }\n        return super.invoke(context, base, method, paramTypes, params);\n    }\n}\n","sourceCodeStart":30,"sourceCodeEnd":57,"githubUrl":"https://github.com/Activiti/Activiti/blob/56435b1a97deeafdc09dd40074b056c89fba5a8a/activiti-core-common/activiti-expression-language/src/main/java/org/activiti/core/el/ELResolverReflectionBlockerDecorator.java#L30-L57","documentation":"ELResolverReflectionBlockerDecorator wraps the JUEL ELResolver and hard-blocks any method invocation whose base object is an instance of java.lang.reflect (package java.lang.reflect), throwing IllegalArgumentException. This is a security guard: JUEL expressions in BPMN/process definitions must not be able to call arbitrary reflection APIs to bypass access control. The throw is deliberate and cannot be disabled safely.","triggerScenarios":"A JUEL expression like ${Class.forName(...).getMethod(...).invoke(...)} or any expression whose evaluated base object's class package equals java.lang.reflect, reaching ELResolver.invoke.","commonSituations":"Malicious or copied expressions embedded in BPMN XML process definitions; users pasting Java-style reflective snippets into expression fields; pentest payloads like ${''.getClass().forName('java.lang.Runtime')} traversing reflective objects.","solutions":["Remove the reflective call from the expression and call a dedicated, allow-listed service bean method instead","Expose a task/service delegate or Spring bean that encapsulates the logic and reference it directly in the expression","If reflection is genuinely needed, perform it server-side in Java code, never inside a JUEL expression","Do not remove the blocker decorator — it protects against expression injection"],"exampleFix":"// before (BPMN expression)\n${execution.setVariable('x', T(java.lang.reflect.Array).newInstance(...))}\n// after\n${myHelperBean.computeArray(execution)}","handlingStrategy":"validation","validationCode":"boolean expressionIsSafe(String expr) {\n  return expr != null && !expr.matches(\"(?s).*java\\\\.reflect\\\\..*\") && !expr.contains(\"forName\") && !expr.contains(\"getMethod\") && !expr.contains(\"invoke(\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    Object result = valueExpression.getValue(elContext);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"Reflection\")) { auditLog.security(\"reflection blocked in EL\"); }\n    throw e;\n}","preventionTips":["Never allow reflective constructs in BPMN expressions","Validate/process-review expression strings before deployment","Expose dedicated allow-listed beans instead of raw classes to EL","Keep ELResolverReflectionBlockerDecorator installed in the EL resolver chain"],"tags":["security","expression-language","juel","reflection-blocked"],"backgroundTag":"expression-injection-blocked","analyzedSha":"56435b1a97deeafdc09dd40074b056c89fba5a8a","analyzedAt":"2026-09-09T21:00:06.703Z","contentChangedAt":"2026-09-09T21:00:06.703Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}