command_injection - Documentation for Ruby 4.0
Description: command_injection: Command Injection Some Ruby core methods accept string data that includes text to be executed as a system command. They should not be called with unk
Keywords: ruby,documentation,command_injection

🔍

No recent searches

# Command Injection

Some Ruby core methods accept string data that includes text to be executed as a system command.

They should not be called with unknown or unsanitized commands.

These methods include:

- `Kernel.exec`

- `Kernel.spawn`

- `Kernel.system`

- ‘command` (backtick method) (also called by the expression `%x[command]`).

- `IO.popen` (when called with other than `"-"`).