Q
Detector Library
Ruby detectors (21/21)
SQL InjectionDivide by ZeroSensitive HTTP ActionInsufficient Protected CredentialsSensitive Information LeakUntrusted DeserializationLog InjectionXML External EntityPath InjectionHttp to File AccessCode InjectionOS Command InjectionResource leakCross Site Scripting (XSS)Untrusted OpenImproper Input ValidationStack Trace ExposureImproper Certificate Validationsend_file InjectionUnsafe File PermissionsTainted Format
OS Command Injection High
User input influences a system command. This allows a malicious user to inject custom commands and take control of a system. This can be sanitized with shellescape to avoid injection.
Detector ID
ruby/os-command-injection@v1.0
Category
Common Weakness Enumeration (CWE) 
Tags
-
Noncompliant example
1class UsersController < ActionController::Base
2 def oscommand_injection_compliant
3 cmd = params[:cmd]
4 # Noncompliant: User data used directly as a command without escaping
5 system(cmd)
6 end
7endCompliant example
1require "shellwords"
2
3class UsersController < ActionController::Base
4 def oscommand_injection_noncompliant
5 cmd = params[:cmd]
6 safe_cmd = Shellwords.escape(cmd)
7 # Compliant: User data has been escaped
8 system(safe_cmd)
9 end
10end