{"action":"closed","issue":{"url":"https://api.github.com/repos/presidentbeef/brakeman/issues/453","repository_url":"https://api.github.com/repos/presidentbeef/brakeman","labels_url":"https://api.github.com/repos/presidentbeef/brakeman/issues/453/labels{/name}","comments_url":"https://api.github.com/repos/presidentbeef/brakeman/issues/453/comments","events_url":"https://api.github.com/repos/presidentbeef/brakeman/issues/453/events","html_url":"https://github.com/presidentbeef/brakeman/issues/453","id":28568049,"number":453,"title":"False positive: unsafe reflection of model attribute","user":{"login":"cainlevy","id":4449,"avatar_url":"https://avatars.githubusercontent.com/u/4449?v=3","gravatar_id":"","url":"https://api.github.com/users/cainlevy","html_url":"https://github.com/cainlevy","followers_url":"https://api.github.com/users/cainlevy/followers","following_url":"https://api.github.com/users/cainlevy/following{/other_user}","gists_url":"https://api.github.com/users/cainlevy/gists{/gist_id}","starred_url":"https://api.github.com/users/cainlevy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cainlevy/subscriptions","organizations_url":"https://api.github.com/users/cainlevy/orgs","repos_url":"https://api.github.com/users/cainlevy/repos","events_url":"https://api.github.com/users/cainlevy/events{/privacy}","received_events_url":"https://api.github.com/users/cainlevy/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2014-03-01T22:59:48Z","updated_at":"2016-04-03T22:47:37Z","closed_at":"2016-04-03T22:47:37Z","body":"```\r\nclass User < ActiveRecord::Base\r\n  FOO = ['Baz']\r\n  BAR = 'Qux'\r\n\r\n  def variations\r\n    User::FOO.first.constantize\r\n    FOO.first.constantize\r\n    User::BAR.constantize\r\n    BAR.constantize\r\n  end\r\nend\r\n```\r\n\r\nOf these four `constantize` calls, Brakeman flags only the first as an unsafe reflection. It appears to be because the array's namespace explicitly includes a model name, which fails [`this check`](https://github.com/presidentbeef/brakeman/blob/5d99f32b7d2f016f97b13430330907b5a14f579d/lib/brakeman/checks/base_check.rb#L85).\r\n\r\nI reduced this out of a situation very similar to #376."}}