File Inclusion Injection (ARCH6139)

Key ruby.security.file-inclusion-injection · Severity critical · Category security · CWE CWE-98

Including a user-controlled path with require/load lets attackers load arbitrary files and run code. Restrict included modules to an allowlist.

Incorrect

def load_plugin(name)
  require "#{Rails.root}/plugins/#{params[:name]}"
end

Correct

PLUGINS = { "csv" => "plugins/csv", "pdf" => "plugins/pdf" }.freeze

def load_plugin(name)
  path = PLUGINS.fetch(name) { raise ArgumentError, "unknown plugin" }
  require Rails.root.join(path).to_s
end

Fix

Never build include paths dynamically; resolve them from a fixed allowlist.