Sha256: 45017c979836f9718491b6013c1bbc0d54cd1d1c582dd469474bf282a3a6084d
Contents?: true
Size: 1.51 KB
Versions: 6
Compression:
Stored size: 1.51 KB
Contents
module Codesake
module Dawn
module Kb
module OwaspRorCheatSheet
class CommandInjection
include PatternMatchCheck
def initialize
message = "Ruby offers a function called \"eval\" which will dynamically build new Ruby code based on Strings. It also has a number of ways to call system commands. While the power of these commands is quite useful, extreme care should be taken when using them in a Rails based application. Usually, its just a bad idea. If need be, a whitelist of possible values should be used and any input should be validated as thoroughly as possible. The Ruby Security Reviewer's Guide has a section on injection and there are a number of OWASP references for it, starting at the top: Command Injection."
super({
:name=>"Owasp Ror CheatSheet: Command Injection",
:kind=>Codesake::Dawn::KnowledgeBase::PATTERN_MATCH_CHECK,
:applies=>["rails"],
:glob=>"*.rb",
:aux_links=>["https://www.owasp.org/index.php/Ruby_on_Rails_Cheatsheet"],
:message=>message,
:attack_pattern => ["eval", "System", "\`", "Kernel.exec"],
:avoid_comments => true,
:mitigation=>"Please validate the code you pass as argument to eval, System, Kernel.exec and friends. If you generate your command line with user controlled values, can lead to an arbitrary code execution."
})
# @debug = true
end
end
end
end
end
end
Version data entries
6 entries across 6 versions & 1 rubygems