Zennoxa Shield
Rules / Ruby
SHIELD-RUBY-008

Code injection via instance_eval or class_eval

highRubyCWE-95CVSS 8.8

What it detects

instance_eval or class_eval on dynamic input executes arbitrary code in an object or class context.

How to fix

Do not evaluate user-supplied strings; refactor to call known methods directly.

Vulnerable — Shield flags thisreport_template.rb
class ReportTemplate
  def render_custom(template)
    # template arrives straight from the request body
    instance_eval(template)
  end
end
Fixed — scans cleanreport_template.rb
class ReportTemplate
  def render_custom(section)
    case section
    when "header"  then render_header
    when "summary" then render_summary
    when "footer"  then render_footer
    end
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-008, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUBY-008: Code injection via instance_eval or class_eval — Zennoxa Shield