Dynamic Method Dispatch (ARCH8132)
Esta página aún no está disponible en tu idioma.
Key kotlin.security.dynamic-method-dispatch · Severity warning · Category security · CWE CWE-470
Flags Class.forName / getMethod / invoke driven by request data.
Incorrect
Section titled “Incorrect”Class.forName(req.getParameter("cls")).getMethod("run").invoke(null)Correct
Section titled “Correct”val handler = handlers[req.getParameter("cls")] ?: throw NotFound()Look the name up in an explicit allow-list map.