1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[DOC] Update command_injection.rdoc

Browse Source 
- Add missing `Kernel.exec` and `Kernel.spawn`.
- Elaborate arguments that can cause injections.
This commit is contained in:
Nobuyoshi Nakada 2024-01-22 12:06:00 +09:00
parent 33290896dc
commit 4a11f50f79
No known key found for this signature in database
GPG Key ID: 3582D74E1FEE4465
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
doc/command_injection.rdoc
View File

@ -7,11 +7,17 @@ They should not be called with unknown or unsanitized commands.
These methods include: These methods include:
- Kernel.exec
- Kernel.spawn
- Kernel.system - Kernel.system
- Kernel.open
- {\`command` (backtick method)}[rdoc-ref:Kernel#`] - {\`command` (backtick method)}[rdoc-ref:Kernel#`]
(also called by the expression <tt>%x[command]</tt>). (also called by the expression <tt>%x[command]</tt>).
- IO.popen(command). - IO.popen (when called with other than <tt>"-"</tt>).
Some methods execute a system command only if the given path name starts
with a <tt>|</tt>:
- Kernel.open(command).
- IO.read(command). - IO.read(command).
- IO.write(command). - IO.write(command).
- IO.binread(command). - IO.binread(command).
@ -21,7 +27,7 @@ These methods include:
- URI.open(command). - URI.open(command).
Note that some of these methods do not execute commands when called Note that some of these methods do not execute commands when called
from subclass \File: from subclass +File+:
- File.read(path). - File.read(path).
- File.write(path). - File.write(path).