🔍

No recent searches

# Command Injection

Some Ruby core methods accept string data that includes text to be executed as a system command.

They should not be called with unknown or unsanitized commands.

These methods include:

- `Kernel.exec`

- `Kernel.spawn`

- `Kernel.system`

- ‘command` (backtick method) (also called by the expression `%x[command]`).

- `IO.popen` (when called with other than `"-"`).