public class ExampleController : Controller
{
    public IActionResult Apply(string EffectName)
    {
        var EffectInstance = Activator.CreateInstance(null, EffectName); // Noncompliant
        object EffectPlugin = EffectInstance.Unwrap();

        if (((IEffect)EffectPlugin).ApplyFilter())
        {
            return Ok();
        }
        else
        {
            return Problem();
        }
    }
}

public interface IEffect
{
    bool ApplyFilter();
}

public class ExampleController : Controller
{
    private static readonly string[] EFFECT_ALLOW_LIST = {
        "SepiaEffect",
        "BlackAndWhiteEffect",
        "WaterColorEffect",
        "OilPaintingEffect"
    };

    public IActionResult Apply(string EffectName)
    {
        if (!EFFECT_ALLOW_LIST.Contains(EffectName))
        {
            return BadRequest("Invalid effect name. The effect is not allowed.");
        }

        var EffectInstance = Activator.CreateInstance(null, EffectName);
        object EffectPlugin = EffectInstance.Unwrap();

        if (((IEffect)EffectPlugin).ApplyFilter())
        {
            return Ok();
        }
        else
        {
            return Problem();
        }
    }
}

public interface IEffect
{
    bool ApplyFilter();
}

public class PluginLoader
{
    public void LoadPlugin(IPluginDescriptor descriptor)
    {
        // CreateInstance(Type, params object[]) — second arg is a constructor argument,
        // not a type name. Type is determined at compile time via typeof + MakeGenericType.
        var instance = (IPlugin)Activator.CreateInstance(
            typeof(PluginWrapper<>).MakeGenericType(descriptor.GetType()),
            descriptor)!;
        instance.Initialize();
    }
}

public interface IPluginDescriptor {}
public interface IPlugin { void Initialize(); }
public class PluginWrapper<T> : IPlugin where T : IPluginDescriptor
{
    public PluginWrapper(T descriptor) {}
    public void Initialize() {}
}