def check_unsafe_reflection result
return unless original? result
call = result[:call]
method = call.method
case method
when :constantize, :safe_constantize
arg = call.target
else
arg = call.first_arg
end
if input = has_immediate_user_input?(arg)
confidence = :high
elsif input = include_user_input?(arg)
confidence = :medium
end
if confidence
message = msg("Unsafe reflection method ", msg_code(method), " called with ", msg_input(input))
warn :result => result,
:warning_type => "Remote Code Execution",
:warning_code => :unsafe_constantize,
:message => message,
:user_input => input,
:confidence => confidence
end
end