Validate polymorphic types against importable models allowlist

Add IMPORTABLE_MODEL_NAMES to RecordSet and verify polymorphic type
columns during import check against this allowlist before calling
constantize. This prevents arbitrary class instantiation from
untrusted import ZIP data.

app/models/account/data_transfer/record_set.rb

@@ -4,6 +4,41 @@ class Account::DataTransfer::RecordSet
 
   IMPORT_BATCH_SIZE = 100
 
+  IMPORTABLE_MODEL_NAMES = %w[
+    Access
+    Account
+    ActionText::RichText
+    ActiveStorage::Attachment
+    ActiveStorage::Blob
+    Assignment
+    Board
+    Board::Publication
+    Card
+    Card::ActivitySpike
+    Card::Goldness
+    Card::NotNow
+    Closure
+    Column
+    Comment
+    Entropy
+    Event
+    Filter
+    Mention
+    Notification
+    Notification::Bundle
+    Pin
+    Reaction
+    Step
+    Tag
+    Tagging
+    User
+    User::Settings
+    Watch
+    Webhook
+    Webhook::DelinquencyTracker
+    Webhook::Delivery
+  ].freeze
+
   attr_reader :account, :model, :attributes
 
   def initialize(account:, model:, attributes: nil)
@@ -113,7 +148,7 @@ class Account::DataTransfer::RecordSet
     def check_association_doesnt_exist(data, association, associated_id)
       if association.polymorphic?
         type_column = association.foreign_type.to_s
-        associated_class = data[type_column].constantize
+        associated_class = verify_model_type(data[type_column])
       else
         associated_class = association.klass
       end
@@ -123,6 +158,14 @@ class Account::DataTransfer::RecordSet
       end
     end
 
+    def verify_model_type(type_name)
+      if IMPORTABLE_MODEL_NAMES.include?(type_name)
+        type_name.constantize
+      else
+        raise IntegrityError, "Unrecognized model type: #{type_name}"
+      end
+    end
+
     def skip_to(file_list, last_id)
       index = file_list.index(last_id)