Shell injection test. DO NOT DEPLOY outside the testing environment.

home.html.erb

<h1>Exec</h1>
<%= form_tag(command_exec_url) do %>

  <div class="actions">
    <%= text_area_tag(:stdin, "", size: "50x20") %>
  </div>
  <%= submit_tag("Execute") %>

<% end %>

routes.rb

Rails.application.routes.draw do
  root 'command#home'
  post 'e' => 'command#exec', as: :command_exec
end

shell.rb

require 'open3'

class CommandController < ApplicationController
  def home
  end

  def exec
    input = params[:stdin] if params
    input = request.body.string unless input

    ret = ''
    value = Open3.popen2("/bin/bash") { |i,o,t|
      i.print input
      i.close
      exitCode = t.value
      ret = o.read
      exitCode
    }

    render plain: ret
  end
end