git.stella-ops.org/bench/reachability-benchmark/cases/java/spring-reflection/src/ReflectController.java

package bench.reachability.springreflection;

import java.util.Map;

public class ReflectController {
    // Reflection sink: user controls Class.forName target
    public static Response run(Map<String, String> body) {
        String className = body.get("class");
        if (className == null || className.isBlank()) {
            return new Response(400, "bad request");
        }
        try {
            Class<?> type = Class.forName(className);
            Object instance = type.getDeclaredConstructor().newInstance();
            return new Response(200, instance.toString());
        } catch (Exception ex) {
            return new Response(500, ex.getClass().getSimpleName());
        }
    }

    public record Response(int status, String body) {}

    public static class Marker {
        @Override
        public String toString() {
            return "marker";
        }
    }
}