StimulusReflex arbitrary method call

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

<details> <summary>Read more</summary> Let's imagine a reflex that uses `@user` as a trusted variable in an `after_reflex` callback.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

• remote_byebug: bind a debugging server
• pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

</details>