Question

I have a Ruby on Rails Application that is using the X virtual framebuffer along with another program to grab images from the web. I have structured my command as shown below:
xvfb-run –server-args=-screen 0 1024x768x24 /my/c++/app #{user_provided_url}

What is the best way to make this call in rails with the maximum amount of safety from user input?

Answer 1

You probably don’t need to sanitize this input in rails. If it’s a URL and it’s in a string format then it already has properly escaped characters to be passed as a URL to a Net::HTTP call. That said, you could write a regular expression to check that the URL looks valid. You could also do the following to make sure that the URL is parse-able:

uri = URI.parse(user_provided_url)

You can then query the object for it’s relevant parts:

uri.path
uri.host
uri.port