Zennoxa Shield
Rules / Ruby
SHIELD-RUBY-007

Code injection via eval

criticalRubyCWE-95CVSS 9.8

What it detects

Passing a variable or interpolated string to eval executes arbitrary Ruby code.

How to fix

Avoid eval on dynamic input; use a safe dispatch table or whitelist of allowed operations.

Vulnerable — Shield flags thisformula_controller.rb
class FormulaController < ApplicationController
  def calculate
    formula = params[:formula]
    result = eval(formula)
    render json: { result: result }
  end
end
Fixed — scans cleanformula_controller.rb
class FormulaController < ApplicationController
  OPERATIONS = { "sum" => ->(a, b) { a + b }, "product" => ->(a, b) { a * b } }.freeze

  def calculate
    op = OPERATIONS.fetch(params[:op]) { return head :unprocessable_entity }
    render json: { result: op.call(params[:a].to_f, params[:b].to_f) }
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-007, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUBY-007: Code injection via eval — Zennoxa Shield