Zennoxa Shield
Rules / Ruby
SHIELD-RUBY-022

Remote code execution via constantize with user input

highRubyCWE-470CVSS 8.1

What it detects

Calling constantize or qualified_const_get on params can instantiate unintended classes.

How to fix

Map user input to allowed classes through an explicit whitelist rather than constantize.

Vulnerable — Shield flags thisapp/controllers/exports_controller.rb
class ExportsController < ApplicationController
  def create
    exporter = params[:format].classify.constantize
    exporter.new(current_user).run
  end
end
Fixed — scans cleanapp/controllers/exports_controller.rb
class ExportsController < ApplicationController
  EXPORTERS = { "csv" => CsvExporter, "pdf" => PdfExporter }.freeze

  def create
    exporter = EXPORTERS.fetch(params[:format]) { raise ActionController::BadRequest }
    exporter.new(current_user).run
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-022, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUBY-022: Remote code execution via constantize with user input — Zennoxa Shield