Calling constantize or qualified_const_get on params can instantiate unintended classes.
Map user input to allowed classes through an explicit whitelist rather than constantize.