title: How do I avoid reflection injection attacks in PHP?
body: <p>I'm writing a class that allows you to bridge HTTP requests with class instances using JSON for data, without any implementation in the class you're bridging to. Basically this is how it works:</p>
  
  <pre><code>// This is just an ordinary class.
  $service = new WeatherService();
  
  $jhi = new JsonHttpInterface($service);
  $jhi-&gt;exec();
  </code></pre>
  
  <p>The <code>JsonHttpInterface</code> class will check the <code>PATH_INFO</code> of the request and call that method, applying any query string parameters as arguments.</p>
  
  <p><code>http://example.com/the_above.php/getWeather?state="CA"</code> would translate to<br>
  <code>$service-&gt;getWeather("CA")</code> (assuming that the name of the first argument is <code>$state</code>).</p>
  
  <p>This is how the method is found and called:</p>
  
  <pre><code>$method = new ReflectionMethod(get_class($this-&gt;instance), $action);
  /*
  ... code that matches query string values to arguments of above method...
  */
  $response = $method-&gt;invokeArgs($this-&gt;instance, $args);
  </code></pre>
  
  <p>Now what I'm wondering is: what are the vulnerabilities of such a system. I've been pretty lenient on error checking, relying on PHP to throw errors when attempting to call non-existent or private/protected methods.</p>
  
  <ul>
  <li>Is it possible to cheat the system?</li>
  <li>Is it possible to pass in an invalid method name that does something other than throw an error?</li>
  <li>Is it possible to refer to a method in a base class, or any other class?</li>
  </ul>
  
  <p>The full source of JsonHttpInterface is available here: <a href="http://blixt.org/js/two-cents.php" rel="nofollow noreferrer">http://blixt.org/js/two-cents.php</a></p>