Question

In my Rails controller, I take a URL that the user inputs and runs the system command wget:

system("wget #{url}")

I’m afraid that the user might put in something like www.google.com && rm -rf ., which would make the controller execute the command

system("wget www.google.com && rm -rf .")

which deletes everything. How should I prevent against this kind of attacks? I’m not sure what other things the user could put in to harm my system.

Answer 1

Per this thread:

You can avoid shell expansion by passing arguments to the script individually:

system("/bin/wget", params[:url])

Per the documentation on Kernel#system this form does not invoke a shell. Constructs like && are shell constructs, so if you use this form, then the param will be passed to /bin/wget literally as an argument.

That said, still be suspicious of input, sanitize where possible, and if feasible, run it as a non-privileged (or better yet, jailed) user.