title: remote code execution in ruby with constantize
body: <p>I'm trying to wrap my head around remote code execution vulnerabilities in ruby/rails when <code>contantize</code> is used.</p>
  
  <p>I understand that being able to provide <em>any</em> class name to the server could be potentially dangerous, but I'm wondering if this <em>by itself</em> is dangerous.</p>
  
  <p>for example, if a rails controller code looks something like this (i.e. executes a hardcoded method on the instantiated object):</p>
  
  <pre><code>klass = params[:class].classify.constantize
  klass.do_something_with_id(params[:id]) if klass.respond_to?('do_something_with_id')
  </code></pre>
  
  <p>Is this code vulnerable? Or only in combination with being able to also specify the method to be called on the class?</p>