Zennoxa Shield
Rules / Ruby
SHIELD-RUBY-005

Command injection via backticks or %x with interpolation

criticalRubyCWE-78CVSS 9.8

What it detects

Interpolating variables inside backticks or %x() executes attacker-controlled shell commands.

How to fix

Use Open3.capture2 with an argument array instead of backticks or %x with interpolation.

Vulnerable — Shield flags thispdf_exporter.rb
class PdfExporter
  def convert(upload_path)
    `libreoffice --headless --convert-to pdf #{upload_path}`
  end
end
Fixed — scans cleanpdf_exporter.rb
require "open3"

class PdfExporter
  def convert(upload_path)
    stdout, status = Open3.capture2("libreoffice", "--headless", "--convert-to", "pdf", upload_path)
    stdout if status.success?
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-005, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUBY-005: Command injection via backticks or %x with interpolation — Zennoxa Shield