Skip to content

Instantly share code, notes, and snippets.

@Papierkorb
Created December 28, 2015 20:51
Show Gist options
  • Save Papierkorb/8902a20be990da525c2f to your computer and use it in GitHub Desktop.
Save Papierkorb/8902a20be990da525c2f to your computer and use it in GitHub Desktop.
# File.read is inherited from IO.read, which in turn allows the user to call out
# to the shell and thus might turn any call to {File.read} into a Remote Code
# Execution vulnerability.
#
# This is insane. So get rid of it.
class File
def self.read(path, *opt)
raise Errno::ENOENT, "Shell methods not allowed" if path.start_with? '|'
super
end
end
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment