Security: Brakeman findings — params-driven constantize (potential RCE)

[kitcommerce]

Brakeman scan on next reported several High confidence UnsafeReflection warnings (potential RCE) due to constantize called on/derived from request parameters.

Scan details:

• Brakeman v8.0.4
• Command: RBENV_VERSION=3.2.7 rbenv exec brakeman -A -w3 --force

Findings (High confidence):

• admin/app/controllers/workarea/admin/bulk_actions_controller.rb:7
  • params[:type].constantize
• admin/app/controllers/workarea/admin/create_segments_controller.rb:66
  • "Workarea::Segment::Rules::#{params[:rule_type].to_s.camelize}".constantize
• admin/app/controllers/workarea/admin/segment_rules_controller.rb:59
  • "Workarea::Segment::Rules::#{params[:rule_type].to_s.camelize}".constantize
• core/app/queries/workarea/admin_search_query_wrapper.rb:27
  • params[:model_type].constantize

Suggested next steps:

• Confirm each param is strictly validated/whitelisted against known classes.
• Prefer mapping param values to classes via explicit hash/lookup instead of constantize.
• Add tests to ensure unexpected values are rejected.

Opened from #798 (verification scan).

[kitcommerce]

PR submitted: #1025

Implemented allowlist-based fixes for all 4 Brakeman findings:

• bulk_actions_controller.rb — new bulk_action_class_for helper checks against Workarea.config.bulk_action_types (SwappableList, plugin-safe)
• create_segments_controller.rb — new segment_rule_class_for helper looks up slug against Workarea.config.segment_rule_types
• segment_rules_controller.rb — same pattern as above
• admin_search_query_wrapper.rb — validates against new Workarea.config.admin_exportable_models (21 built-in models, SwappableList)

Brakeman RCE warnings: 3 → 0 (total warnings 12 → 9). Tests added for all allowlist rejections.