How safe is it to use send() on user input?

Question

ruby

There is a class:

class Klass
 def method1(opts={})
 end

 def method2(*args)
 end
end

If I want to accept both method names and arguments from the user ({ "user_input": "method2('some, [evil], {parameters}')" }), would it be enough to restrict:

Klass.send(user_input_method_name, user_input_args) if user_input_method_name.in?(Klass.public_methods(false))

And inside the methods to consider arguments only as strings?

Answer 1

Never trust user input. Use whitelist to specify allowed methods.