Dynamic Method Dispatch (ARCH8132)

Key kotlin.security.dynamic-method-dispatch · Severity warning · Category security · CWE CWE-470

Flags Class.forName / getMethod / invoke driven by request data.

Incorrect

Class.forName(req.getParameter("cls")).getMethod("run").invoke(null)

Correct

val handler = handlers[req.getParameter("cls")] ?: throw NotFound()

Fix

Look the name up in an explicit allow-list map.