reflect package. reflect.ValueOf() and reflect.New() with user-controlled type strings enable dynamic code execution — a finding for unsafe reflection rules.
.New().New()SinkNew(typ Type) Value
Creates new zero value of type. Unsafe when type is derived from user input.
0.ValueOf()NeutralValueOf(i any) Value
Returns Value wrapping i. Taint propagates through reflect operations.
| FQN | Field | |
|---|---|---|
| reflect | fqns[0] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
// standard library — no go.mod entry required
from codepathfinder.go_rule import GoReflect