Command injection missed when backticks have operator

[JacobEvelyn]

Background

Brakeman version: 4.2.1
Rails version: 5.1.4
Ruby version: 2.5.1

Issue

Brakeman correctly spots this vulnerability:

def dangerous(path)
  `echo #{path}`
end

But misses it when we change the code to:

def dangerous(path)
  `echo #{path}`.chomp
end

It appears to miss all command injection vulnerabilities in backticks that have a method called on them, regardless of what that method is or does.

[presidentbeef]

Thanks, fixing that turned up quite a few missed issues.

[JacobEvelyn]

Awesome, glad to hear it! Out of curiosity (not trying to nag), what does your RubyGems release cadence look like? (Don't go out of your way to cut a new release just for us; I'm really just wondering how often we should expect new gem versions in the future.)

[presidentbeef]

Funny you should ask. I was just thinking there should be an April release but probably not going to happen. Maybe sometime next week.

BTW, as of today, there have been 106 releases in 2,800 days, so on average a release every 26 days :P

[JacobEvelyn]

Great, thanks for the info!