Why avoid Method.invoke?

Question

In guideline 9-11 / ACCESS-11

Be aware java.lang.reflect.Method.invoke is ignored for checking the immediate caller

of the Secure Coding Guidelines for Java SE, it is stated that the Method.invoke implementation is ignored when determining the immediate caller, because otherwise the action would be performed with all permissions. So far that's clear to me, but then it is stated:

Therefore, avoid Method.invoke

I understand it is good that the Method.invoke implementation is ignored when determining the immediate caller, but why it should be avoided? What would be the reason to avoid it?

Answer 1

There is an inherent risk when using reflection for invoking methods ( like in Java or C#). Quoting from the OWASP vulnerability description page for Unsafe use of reflection

If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers.