Menu
I want to do the following securely
system "echo '#{params[:message]}' > /dev/log"
What is the proper way for escaping arguments when calling a native command?
(Example evil input: '; rm -Rf *; echo 'I won.)
970
First, note that when Ruby calls out to a shell, it typically calls /bin/sh , not Bash. Some Bash syntax is not supported by /bin/sh on all systems. This is like many other languages, including Bash, PHP, and Perl. Returns the result (i.e. standard output) of the shell command.
Press Ctrl twice to invoke the Run Anything popup. Type the ruby script. rb command and press Enter . If necessary, you can specify the required command-line options and script arguments.
Pipe /etc/printcap into a file¶ ↑ In this example we will read the operating system file /etc/printcap , generated by cupsd , and then output it to a new file relative to the pwd of sh . sh = Shell.
exec replaces the current process with the new process and never returns. system invokes another process and returns its exit value to the current process. Using backticks invokes another process and returns the output of that process to the current process.
If you do
system "echo", params[:message]
Then the second argument, will be sent as an argument, it will not be executed.
167
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
