Dynamic method dispatch (ARCH3132)

Key typescript.security.dynamic-method-dispatch · Severity warning · Category security · CWE CWE-470

Taking the method name to call straight from user input lets attackers invoke unintended functions. Constrain callable methods with an allowlist.

Incorrect

const service: Record<string, Function> = new UserService() as any;

app.post("/rpc", (req, res) => {
  const result = service[req.body.method](req.body.args);
  res.json({ result });
});

Correct

const handlers: Record<string, (args: unknown) => unknown> = {
  getProfile: (a) => getProfile(a),
  listOrders: (a) => listOrders(a),
};

app.post("/rpc", (req, res) => {
  const fn = handlers[req.body.method];
  if (!fn) return res.sendStatus(400);
  res.json({ result: fn(req.body.args) });
});

Fix

Restrict callable methods to an explicit allowlist (dispatch table); never use the raw name directly.