osirium Posted October 19, 2017 Report Posted October 19, 2017 Using open-uri? Check your code - you're playing with fire! " Ruby’s OpenURI is an easy-to-use wrapper for net/http, net/https and net/ftp. As far as I know it’s the most popular way to read URL content, make a GET request or download a file. require "open-uri" internally patches Kernel.open leaving you one step away from remote code execution and reading local files! Here are some examples: open(params[:url]) is remote code execution for url=|ls Didn’t you know if it starts with a pipe Ruby executes it?! Ouch. " Source: https://sakurity.com/blog/2015/02/28/openuri.html Quote
