Instead, define a method in your string class
def constantize_with_care(list_of_klasses=[]) list_of_klasses.each do |klass| return self.constantize if self == klass.to_s end raise "Not allowed to constantize #{self}!" end
Then use
"user".constantize_with_care([User])
and now you can do something like this
params[:name].constantize_with_care([User])
Without any security issues.
Anil maurya
source share