this post was submitted on 22 Jul 2023
6 points (87.5% liked)

Ruby

530 readers
1 users here now

A community for discussion and news about Ruby programming.

Learning Ruby?

Tools

Documentation

Books

Screencasts

News and updates

founded 1 year ago
MODERATORS
 

Dozens of Ruby-related CVEs have been caused by user input being passed to the top-level Kernel.open() method, which not only accepts paths or URIs (if open-uri has been loaded), but also "|command-here" commands which are then opened using IO.popen() resulting in Remote Command Execution (RCE) vulnerabilities. In the next minor Ruby version (3.3.0) a deprecation warning will be printed if a "|command-here" input is given to Kernel.open(). Hopefully, in Ruby 4.0 this insecure feature will be removed.

top 1 comments
sorted by: hot top controversial new old
[–] [email protected] 2 points 1 year ago

I'm glad security is getting some good efforts!