Pattern: Possible command injection
Issue: -
Checks for string interpolation and parameters in calls to Kernel#system
, Kernel#exec
, Kernel#syscall
, and inside backticks.
Examples of command injection vulnerabilities:
system("rf -rf #{params[:file]}")
exec(params[:command])
unlink #{params[:something}