OS command injection (ARCH6102)

Key ruby.security.os-command-injection · Severity error · Category security · CWE CWE-78

Building the command string from untrusted input, or running it through a shell, lets attackers inject arbitrary commands.

Incorrect

def ping(host)
  `ping -c 1 #{host}`
end

Correct

def ping(host)
  out, _ = Open3.capture2("ping", "-c", "1", host)
  out
end

Fix

Use APIs that pass arguments as an array (Open3, array-form system) instead of a shell; never interpolate input into a command.