Dynamic Method Dispatch (ARCH4132)

Key java.security.dynamic-method-dispatch · Severity warning · Category security · CWE CWE-470

Taking the callee method name from user input and invoking it via reflection lets attackers trigger unintended, dangerous methods. Map callable methods through an allowlist.

Incorrect

Method m = service.getClass().getMethod(request.getParameter("action"));
m.invoke(service); // user can select any method

Correct

Map<String, Runnable> actions = Map.of(
    "approve", service::approve,
    "reject", service::reject);
Runnable action = actions.get(request.getParameter("action"));
if (action == null) throw new IllegalArgumentException();
action.run();

Fix

Map callable actions through a fixed allowlist instead of user-controlled reflective dispatch.