Dynamic Method Dispatch (ARCH7132)

Key php.security.dynamic-method-dispatch · Severity warning · Category security · CWE CWE-470

Dynamic dispatch where the method/function name comes from user input (variable functions, call_user_func) lets an attacker trigger any method on the object.

Incorrect

<?php
$action = $_GET['action'];
$controller->$action(); // any public method can be invoked

Correct

<?php
$allowed = ['index', 'show', 'list'];
$action = $_GET['action'] ?? '';
if (in_array($action, $allowed, true)) {
    $controller->$action();
}

Fix

Validate the dynamically dispatched name against a fixed allowlist; prefer an explicit switch/map where possible.