Avoid the use of class loading as it greatly complicates code
analysis. If the application requires dynamic class loading, it should
be well understood and documented. All classes that may be loaded should
be predefined and avoid the use of dynamically created classes from byte
arrays.
Other Notes
The class loader executes the static initializers when the class is
loaded. A malicious attack may be hidden in the static initializer and
therefore does not require the execution of a specific method. An attack may
also be hidden in any other method in the dynamically loaded code. The use
of dynamic code could also enable an attacker to insert an attack into an
application after it has been deployed. The attack code would not be in the
baseline, but loaded dynamically while the application is running.
Description
