class RuboCop::Cop::EightyFourCodes::CommandLiteralInjection

Check for use of `/bin/ls #{params}` and %x(/bin/ls #{params})

Passing user input to “ and %x without sanitization and parameterization can result in command injection

@example

# bad
%x(/bin/ls #{filename})

# good (parameters)
system("/bin/ls", filename)
# even better
exec("/bin/ls", shell_escape(filename))

Constants

MSG

Public Instance Methods

check_for_interpolation(node) click to toggle source
# File lib/rubocop/cop/eighty_four_codes/command_literal_injection.rb, line 29
def check_for_interpolation(node)
  return if node.children.none? { |n| literal_var?(n) }

  add_offense(node)
end
on_xstr(node) click to toggle source
# File lib/rubocop/cop/eighty_four_codes/command_literal_injection.rb, line 25
def on_xstr(node)
  check_for_interpolation(node)
end