Preview Ruby 4.1 is a preview. It can change before the final release. Switch to Ruby 4.0 →
guide · Ruby 4.1
Command Injection
Some Ruby core methods accept string data that includes text to be executed as a system command.
They should not be called with unknown or unsanitized commands.
These methods include:
-
‘command` (backtick method) (also called by the expression
%x[command]). -
IO.popen(when called with other than"-").
From doc/security/command_injection.rdoc in Ruby 4.1.
View on GitHub ↗
docs.ruby-lang.org ↗