Dynamic Code Execution (ARCH6131)

Key ruby.security.dynamic-code-execution · Severity critical · Category security · CWE CWE-95

Running untrusted strings as code with eval, instance_eval, or class_eval is the broadest remote-code-execution vector. Avoid dynamic code evaluation.

Incorrect

def compute(expr)
  eval(expr)
end

compute(params[:formula])

Correct

OPERATIONS = { "sum" => ->(a, b) { a + b }, "max" => ->(a, b) { [a, b].max } }

def compute(name, a, b)
  op = OPERATIONS.fetch(name) { raise ArgumentError, "unsupported" }
  op.call(a, b)
end

Fix

Remove the eval family; dispatch allowed operations through an explicit map.