Common Ruby Security Pitfalls
Avoid the traps that repeatedly cause incidents: insecure deserialization, path traversal, unsanitised shell commands, and missing CSRF protections.
Beware of these anti-patterns
- eval/exec injection: interpreting user input as code.
- Command injection: interpolating user input into backticks or `system` string commands.
- Path traversal: concatenating user input into file paths (`File.read("uploads/#{params[:file]}")`).
- Open redirects: redirecting to unvalidated URLs provided by the user.
- Mass assignment: permitting sensitive attributes (role, admin) to be set via forms.
Defensive measures
- Use `File.join` with whitelisted directories for file operations.
- Whitelist redirect targets or check with `uri.host` before redirecting.
- Always require CSRF tokens for state-changing actions; disable only for API endpoints that implement their own auth.
- Review logs and metrics (e.g., failed login rates, unexpected HTTP responses) for security anomalies.