package bench.reachability.springreflection; import java.util.Map; public class ReflectController { // Reflection sink: user controls Class.forName target public static Response run(Map body) { String className = body.get("class"); if (className == null || className.isBlank()) { return new Response(400, "bad request"); } try { Class type = Class.forName(className); Object instance = type.getDeclaredConstructor().newInstance(); return new Response(200, instance.toString()); } catch (Exception ex) { return new Response(500, ex.getClass().getSimpleName()); } } public record Response(int status, String body) {} public static class Marker { @Override public String toString() { return "marker"; } } }