Zennoxa Shield
Rules / Ruby
SHIELD-RUBY-009

Unsafe method dispatch via send with user input

highRubyCWE-94CVSS 8.1

What it detects

Calling send or public_send with a params-derived method name lets attackers invoke arbitrary methods.

How to fix

Whitelist allowed method names before dispatching with send.

Vulnerable — Shield flags thisusers_controller.rb
class UsersController < ApplicationController
  def profile_field
    user = User.find(params[:id])
    render json: { value: user.send(params[:field]) }
  end
end
Fixed — scans cleanusers_controller.rb
class UsersController < ApplicationController
  ALLOWED_FIELDS = %w[name email bio].freeze

  def profile_field
    field = params[:field]
    return head :forbidden unless ALLOWED_FIELDS.include?(field)
    render json: { value: User.find(params[:id]).public_send(field) }
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-009, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUBY-009: Unsafe method dispatch via send with user input — Zennoxa Shield