Dynamic Method Dispatch (ARCH6132)

Key ruby.security.dynamic-method-dispatch · Severity warning · Category security · CWE CWE-470

send/public_send calls whose method name comes from user input enable invocation of unintended methods. Restrict callable methods to an allowlist.

Incorrect

def run(record)
  record.send(params[:action])
end

Correct

ALLOWED = %w[publish archive].freeze

def run(record)
  action = params[:action]
  raise ArgumentError unless ALLOWED.include?(action)

  record.public_send(action)
end

Fix

Validate method names against an allowlist and use public_send.