StimulusReflex arbitrary method call
SummaryMore methods than expected can be called on reflex instances. Being able to call some of them has security implications.DetailsTo invoke a reflex a websocket message of the following shape is sent:The server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`.
It then attempts to call `method_name` on the instance with the provided arguments [ref](https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83):This is problematic as `reflex.method(method_name)` can be more methods than those explicitly specified by the developer in their reflex class. A good example is the `instance_variable_set` method.This variable can be overwritten using the following message:Here are other interesting methods that were found to be available for the [ChatReflex sample reflex](https://github.com/hopsoft/stimulus_reflex_expo/blob/dcce8c36a6782d1e7f57f0e2766a3f6fd770b3b1/app/reflexes/chat_reflex.rb)`remote_byebug`: bind a debugging server`pry`: drop the process in a REPL sessionAll in all, only counting  `:req` and `:opt` parameters helps.
For example around [version 1.0](https://github.com/stimulusreflex/stimulus_reflex/blob/1f610b636abfed27de2c61104aebd1ac98180d5b/lib/stimulus_reflex/channel.rb#L41) only `.arity` was checked which allowed access to the `system` method (`.arity == -1`)Using `public_send` instead of `send` does not help but the following payloads **do not** work since `:rest` parameters are not counted in the current versionPre-versions of 3.5.0 added a `render_collection` method on reflexes with  a `:req` parameter. Calling this method could lead to arbitrary code execution:PatchesPatches are [available on RubyGems](https://rubygems.org/gems/stimulus_reflex) and on [NPM](https://npmjs.org/package/stimulus_reflex).The patched versions are:[`3.4.2`](https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2)[`3.5.0.rc4`](https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4)WorkaroundYou can add this guard to mitigate the issue if running an unpatched version of the library.1.) Make sure all your reflexes inherit from the `ApplicationReflex` class
2.) Add this `before_reflex` callback to your `app/reflexes/application_reflex.rb` file: