Files
codeql/ruby/ql/src/queries/security/cwe-078/examples/kernel_open.rb
2024-04-27 09:53:54 +01:00

12 lines
244 B
Ruby

require "open-uri"
class UsersController < ActionController::Base
def create
filename = params[:filename]
open(filename) # BAD
web_page = params[:web_page]
URI.open(web_page) # BAD - calls `Kernel.open` internally
end
end