Question

I’m using Ruby’s system method.

system("/bin/wget", "-pk", "-nd", "-P", "/public/download", "#{URL}")

where URL is filled in by the user.

What checks should I perform on the server against URL to make sure that the user is not doing something malicious?

Answer 1

My understanding is that in the way you’ve called it, you don’t have to worry about someone passing in say ; rm -rf *. However, if wget does anything special to the URL you might. For example, curl lets you do some regex/range/wildcard stuff in the URL itself.

You might consider running URL through URI.parse and catch URI::InvalidURIError.