--- title: TSU-08 Insecure Custom Java in Mendix | Omnext description: Java actions run below the low-code layer, where entity access is not applied for you. System context, XPath injection, unencoded output and how to check them. image: https://www.omnext.com/hubfs/raw_assets/public/Cerios%20Solutions%20Theme%20-%20Omnext/omx-sept-2026/images/omx-og-default.png --- [![Omnext](https://www.omnext.com/hubfs/Omnext/Omnext%20-%20Logo%20+%20Slogan.svg)](https://www.omnext.com?hsLang=en) [Platform](https://www.omnext.com/mendix-quality-analysis?hsLang=en) [Mendix quality analysisMaintainability, architecture and technical debt, scored every sprint.](https://www.omnext.com/mendix-quality-analysis?hsLang=en)[Mendix security analysisThe S-Unit Top 10, checked automatically on every build.](https://www.omnext.com/mendix-security-analysis?hsLang=en)[DevAssist for Studio ProFindings in the IDE, while the developer is still in the model.](https://www.omnext.com/devassist?hsLang=en)[Omnext MCPAll analysis data, ready for your AI agents and assistants.](https://www.omnext.com/omnext-mcp?hsLang=en) [Pricing](https://www.omnext.com/pricing?hsLang=en) [Resources](https://www.omnext.com/resources?hsLang=en) [Knowledge baseThe full product documentation, for everyone who works with Omnext.](https://help.omnext.com/?hsLang=en)[Fact sheetsQuality and security analysis for Mendix, in two short PDFs.](https://www.omnext.com/fact-sheet-request?hsLang=en)[Mendix security self-assessmentTen questions, five minutes, your security profile on screen.](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[CoE Maturity ScanWhere your Center of Excellence stands today.](https://www.omnext.com/en/coe-maturity-scan?hsLang=en)[NIS2 readiness checklistTwenty-four items, your readiness score on screen.](https://www.omnext.com/nis2-readiness-checklist-mendix?hsLang=en)[The S-Unit Top 10Ten Mendix-specific security categories, explained.](https://www.omnext.com/s-unit-top-10?hsLang=en)[BlogArticles on Mendix quality, security and governance.](https://www.omnext.com/blog?hsLang=en)[Trust CenterHosting, data handling and certifications.](https://www.omnext.com/trust-center?hsLang=en)[All resourcesEverything in one overview.](https://www.omnext.com/resources?hsLang=en) [Partners](https://www.omnext.com/partners?hsLang=en)[Contact](https://www.omnext.com/contact?hsLang=en) Search [Log in](https://portal.omnext.net/)[Request a demo](https://www.omnext.com/demo?hsLang=en) Menu [Platform](https://www.omnext.com/mendix-quality-analysis?hsLang=en)[Mendix quality analysis](https://www.omnext.com/mendix-quality-analysis?hsLang=en)[Mendix security analysis](https://www.omnext.com/mendix-security-analysis?hsLang=en)[DevAssist for Studio Pro](https://www.omnext.com/devassist?hsLang=en)[Omnext MCP](https://www.omnext.com/omnext-mcp?hsLang=en)[Pricing](https://www.omnext.com/pricing?hsLang=en)[Resources](https://www.omnext.com/resources?hsLang=en)[Knowledge base](https://help.omnext.com/?hsLang=en)[Fact sheets](https://www.omnext.com/fact-sheet-request?hsLang=en)[Mendix security self-assessment](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[CoE Maturity Scan](https://www.omnext.com/en/coe-maturity-scan?hsLang=en)[NIS2 readiness checklist](https://www.omnext.com/nis2-readiness-checklist-mendix?hsLang=en)[The S-Unit Top 10](https://www.omnext.com/s-unit-top-10?hsLang=en)[Blog](https://www.omnext.com/blog?hsLang=en)[Trust Center](https://www.omnext.com/trust-center?hsLang=en)[All resources](https://www.omnext.com/resources?hsLang=en)[Partners](https://www.omnext.com/partners?hsLang=en)[Contact](https://www.omnext.com/contact?hsLang=en) [Request a demo](https://www.omnext.com/demo?hsLang=en)[Log in](https://portal.omnext.net/) S-Unit Top 10 · TSU-08 # Insecure custom Java Custom Java sits underneath the low-code layer, where the platform stops applying authorisation and validation for you. What the model enforces everywhere else becomes the developer's responsibility in this one file, and a single action running in the wrong context can quietly undo the entity access rules the whole application depends on. [Take the free security self-check](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[All ten categories](https://www.omnext.com/s-unit-top-10?hsLang=en) Where it goes wrong ## How this shows up in a Mendix application. ### System or Sudo where User belongs Running in an elevated context means entity access rules are never evaluated, and nothing in the model shows it. ### No check inside the privileged block The elevated operation performs no authentication or authorisation of its own, because the caller was assumed to be trusted. ### XPath built by string assembly User input concatenated into a query instead of parameterised, which is injection with a different syntax. ### Request data taken as given Values from the URL, body or headers used without validation and without checking whether this caller may ask for this. ### HTML assembled by hand Output built by string concatenation with no encoding, which lands cross-site scripting in the page. ### Libraries on default settings Third-party libraries, XML parsers above all, used without reading their own security guidance. Impact ## What it lets someone do. Every item below has been found in production applications. None of them requires a sophisticated attacker: they require somebody who reads the page source, edits a request or simply logs in. Read and write data the access rules were supposed to protect Bypass authentication altogether through an unguarded request handler Reach the file system or the operating system under the application Execute script in another user's session through unencoded output Prevention ## How to keep it out. ### Use Java only where it is needed A microflow or a REST integration handles most of what Java gets used for, and it keeps the security model visible. ### User context by default Treat Sudo as the exception, log it, and add an explicit authorisation check wherever it runs. ### Parameterise and encode Placeholders in every XPath query, and a template engine that encodes variables rather than trusting the author. Automated ## What Omnext checks for you. Omnext analyses custom Java alongside the model: XPath queries built from unsanitised input, custom request handlers, hard-coded cryptographic keys, error messages printed straight to the user, insecure logging and calls to System.exit. [See the security analysis](https://www.omnext.com/mendix-security-analysis?hsLang=en) Source ## The framework is The S-Unit's. The S-Unit Top 10 is the work of The S-Unit, the Mendix security specialists. They built it from more than ten years of offensive security work and hundreds of Mendix penetration tests, and they maintain the canonical version. Omnext automates the checks in the Security Analysis module; the framework itself is theirs, and this page explains it in our own words. [Read the original on the-s-unit.nl](https://the-s-unit.nl/en/tsu-08-insecure-custom-java/) Keep reading ## The rest of the S-Unit Top 10. Ten categories in total. [See the full list](https://www.omnext.com/s-unit-top-10?hsLang=en). [TSU-07Insecure custom authentication](https://www.omnext.com/tsu-07-insecure-custom-authentication?hsLang=en) [TSU-09Insecure UI components](https://www.omnext.com/tsu-09-insecure-ui-components?hsLang=en) Next step ## Which of the ten are you sure about? Ten questions, about five minutes, results on screen. Or let the scan answer all ten with evidence from your own model. [Take the self-check](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[Request a demo](https://www.omnext.com/demo?hsLang=en) ![Omnext](https://www.omnext.com/hubfs/Omnext/Omnext%20-%20Logo%20-%20Inverted.svg) Automated quality and security analysis for Mendix. Build Fast. Stay in Control. ISO 27001:2023GDPRHosted on Azure (EU) Platform[Quality Analysis for Mendix](https://www.omnext.com/mendix-quality-analysis?hsLang=en)[Security Analysis (SAST)](https://www.omnext.com/mendix-security-analysis?hsLang=en)[DevAssist for Studio Pro](https://www.omnext.com/devassist?hsLang=en)[Omnext MCP](https://www.omnext.com/omnext-mcp?hsLang=en)[Pricing](https://www.omnext.com/pricing?hsLang=en) Resources[Fact sheets](https://www.omnext.com/fact-sheet-request?hsLang=en)[Security Self-Assessment](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[CoE Maturity Scan](https://www.omnext.com/en/coe-maturity-scan?hsLang=en)[Blog](https://www.omnext.com/blog?hsLang=en)[Knowledge base](https://help.omnext.com/?hsLang=en)[All resources](https://www.omnext.com/resources?hsLang=en) Company[Partners](https://www.omnext.com/partners?hsLang=en)[Trust Center](https://www.omnext.com/trust-center?hsLang=en)[Contact](https://www.omnext.com/contact?hsLang=en)[Request a demo](https://www.omnext.com/demo?hsLang=en) ContactCerios | Omnext B.V. Orteliuslaan 1000 3528 BD Utrecht, The Netherlands[contact@omnext.com](mailto:contact@omnext.com)[LinkedIn](https://www.linkedin.com/company/omnext/) © 2026 Cerios | Omnext B.V. · part of Cerios Solutions · KvK 09115372[Privacy policy](https://www.omnext.com/privacy-policy?hsLang=en)[Security & disclosure](https://www.omnext.com/trust-center?hsLang=en)