{"action":"created","issue":{"url":"https://api.github.com/repos/presidentbeef/brakeman/issues/943","repository_url":"https://api.github.com/repos/presidentbeef/brakeman","labels_url":"https://api.github.com/repos/presidentbeef/brakeman/issues/943/labels{/name}","comments_url":"https://api.github.com/repos/presidentbeef/brakeman/issues/943/comments","events_url":"https://api.github.com/repos/presidentbeef/brakeman/issues/943/events","html_url":"https://github.com/presidentbeef/brakeman/issues/943","id":181106193,"number":943,"title":"False positive - Unsafe reflection method constantize","user":{"login":"Unknown-Guy","id":640231,"avatar_url":"https://avatars.githubusercontent.com/u/640231?v=3","gravatar_id":"","url":"https://api.github.com/users/Unknown-Guy","html_url":"https://github.com/Unknown-Guy","followers_url":"https://api.github.com/users/Unknown-Guy/followers","following_url":"https://api.github.com/users/Unknown-Guy/following{/other_user}","gists_url":"https://api.github.com/users/Unknown-Guy/gists{/gist_id}","starred_url":"https://api.github.com/users/Unknown-Guy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Unknown-Guy/subscriptions","organizations_url":"https://api.github.com/users/Unknown-Guy/orgs","repos_url":"https://api.github.com/users/Unknown-Guy/repos","events_url":"https://api.github.com/users/Unknown-Guy/events{/privacy}","received_events_url":"https://api.github.com/users/Unknown-Guy/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-10-05T09:34:31Z","updated_at":"2016-12-19T02:53:29Z","closed_at":null,"body":"``` ruby\ndef find_and_authorize_application\n  @application = Application.find(params[:application_id])\n  application_class = @application.class.name.demodulize\n  policy_class = \"Hr::#{application_class}Policy\".constantize\n  application_policy = policy_class.new(current_user, @application)\n  # [..]\nend\n```\n\n```\nUnsafe reflection method constantize called with parameter value near line 30: \"Hr::#{Application.find(params[:application_id]).class.name.demodulize}Policy\".constantize\n```\n\nMaybe I'm not seeing something obvious but this doesn't seem to be exploitable.\n"},"comment":{"url":"https://api.github.com/repos/presidentbeef/brakeman/issues/comments/267870932","html_url":"https://github.com/presidentbeef/brakeman/issues/943#issuecomment-267870932","issue_url":"https://api.github.com/repos/presidentbeef/brakeman/issues/943","id":267870932,"user":{"login":"bf4","id":142914,"avatar_url":"https://avatars.githubusercontent.com/u/142914?v=3","gravatar_id":"","url":"https://api.github.com/users/bf4","html_url":"https://github.com/bf4","followers_url":"https://api.github.com/users/bf4/followers","following_url":"https://api.github.com/users/bf4/following{/other_user}","gists_url":"https://api.github.com/users/bf4/gists{/gist_id}","starred_url":"https://api.github.com/users/bf4/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bf4/subscriptions","organizations_url":"https://api.github.com/users/bf4/orgs","repos_url":"https://api.github.com/users/bf4/repos","events_url":"https://api.github.com/users/bf4/events{/privacy}","received_events_url":"https://api.github.com/users/bf4/received_events","type":"User","site_admin":false},"created_at":"2016-12-19T02:53:29Z","updated_at":"2016-12-19T02:53:29Z","body":"Probably best thing to do is to add it to the ignore list"}}
{"actor":{"display_login":"bf4"}}