Zennoxa Shield
Rules / Ruby
SHIELD-RUBY-017

XSS via unescaped ERB output tag

highRubyCWE-79CVSS 7.4

What it detects

The unescaped ERB output tag renders content without HTML escaping and can inject attacker markup.

How to fix

Use the escaping ERB tag and only bypass escaping for content you fully control.

Vulnerable — Shield flags thisapp/controllers/comments_controller.rb
class CommentsController < ApplicationController
  def show
    @comment = Comment.find(params[:id])
    render inline: "<div class='comment'><%== @comment.body %></div>"
  end
end
Fixed — scans cleanapp/controllers/comments_controller.rb
class CommentsController < ApplicationController
  def show
    @comment = Comment.find(params[:id])
    render inline: "<div class='comment'><%= @comment.body %></div>"
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-017, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUBY-017: XSS via unescaped ERB output tag — Zennoxa Shield