Template injection (ARCH6130)

Key ruby.security.template-injection · Severity error · Category security · CWE CWE-1336

Building the template itself from untrusted input and rendering it lets attackers run code in the template engine (SSTI/RCE).

Incorrect

def render_msg(input)
  ERB.new("Hello #{input}").result(binding)
end

Correct

def render_msg(input)
  ERB.new("Hello <%= name %>").result_with_hash(name: input)
end

Fix

Keep templates static; pass user input as data to the render, never into the template source.