class RuboCop::Cop::EightyFourCodes::CommandLiteralInjection
Check for use of `/bin/ls #{params}` and %x(/bin/ls #{params})
Passing user input to “ and %x without sanitization and parameterization can result in command injection
@example
# bad %x(/bin/ls #{filename}) # good (parameters) system("/bin/ls", filename) # even better exec("/bin/ls", shell_escape(filename))
Constants
- MSG
Public Instance Methods
check_for_interpolation(node)
click to toggle source
# File lib/rubocop/cop/eighty_four_codes/command_literal_injection.rb, line 29 def check_for_interpolation(node) return if node.children.none? { |n| literal_var?(n) } add_offense(node) end
on_xstr(node)
click to toggle source
# File lib/rubocop/cop/eighty_four_codes/command_literal_injection.rb, line 25 def on_xstr(node) check_for_interpolation(node) end