Ruby / Rails source review
When it applies
Reviewing Ruby source, usually Rails. Rails is safe by default in many places, so the bugs cluster
in dynamic dispatch, mass assignment gaps, raw SQL, and unsafe deserialization/rendering.
Why it works
Ruby's metaprogramming (send, constantize, eval) turns strings into method/class/code
references, and Rails helpers have unsafe escape hatches (.html_safe, where("...#{x}..."),
render inline:). Tracing params to these is the whole game — and Brakeman automates the first pass.
Sinks & patterns (grep, then trace to user input)
- Code exec:
eval, instance_eval, class_eval, backticks/system/%x/exec/open("|…").
- Dynamic dispatch:
send/public_send/__send__ with a param method name; constantize/
safe_constantize on input (arbitrary class instantiation).
- SQLi: string interpolation in
where("name = '#{x}'"), find_by_sql, order(params[:sort]),
pluck/group with input.
- Mass assignment: missing/loose Strong Parameters (
params.permit!, permit(*keys)).
- Deserialization:
YAML.load(vs safe_load), Marshal.load, Oj in compat mode on input.
- XSS/SSRF/render:
.html_safe/raw on user data, render inline:/render text: with input,
open/Net::HTTP on user URLs, send_file/params[:path] traversal.
Framework specifics
- Rails:
permit/require correctness, skip_before_action :verify_authenticity_token (CSRF),
redirect_to params[...] (open redirect), route globbing exposing actions, secrets in
credentials/ENV, default protect_from_forgery disabled on APIs.
Method
- Run
brakeman and bundler-audit; triage the warnings (Brakeman is high-signal for Rails).
rg 'send\(|constantize|eval|where\(".*#\{|html_safe|YAML.load|render.*inline' → trace to params.- Check every controller's strong-params and
before_action auth coverage.
- Confirm exploitable findings with
web-sqli, web-deserialization, web-ssrf, web-idor.
Gotchas
send to a fixed symbol is fine; the bug is send(params[:action]).YAML.safe_load is safe; plain YAML.load on input is RCE-capable.- Brakeman false positives exist — always confirm the param actually reaches the sink.
References
Brakeman docs; Rails Security Guide; OWASP Ruby on Rails cheat sheet.
1---2name: code-review-ruby3description: Security review of Ruby code — dangerous sinks and Rails pitfalls. Load when reviewing a Ruby/Rails codebase/PR, on .rb source in scope, or "review this Rails app". Signals: Gemfile, config/routes.rb, ActiveRecord, ERB, YAML.load, send/constantize.4---56# Ruby / Rails source review78## When it applies9Reviewing Ruby source, usually Rails. Rails is safe by default in many places, so the bugs cluster10in dynamic dispatch, mass assignment gaps, raw SQL, and unsafe deserialization/rendering.1112## Why it works13Ruby's metaprogramming (`send`, `constantize`, `eval`) turns strings into method/class/code14references, and Rails helpers have unsafe escape hatches (`.html_safe`, `where("...#{x}...")`,15`render inline:`). Tracing params to these is the whole game — and Brakeman automates the first pass.1617## Sinks & patterns (grep, then trace to user input)18- **Code exec**: `eval`, `instance_eval`, `class_eval`, backticks/`system`/`%x`/`exec`/`open("|…")`.19- **Dynamic dispatch**: `send`/`public_send`/`__send__` with a param method name; `constantize`/20 `safe_constantize` on input (arbitrary class instantiation).21- **SQLi**: string interpolation in `where("name = '#{x}'")`, `find_by_sql`, `order(params[:sort])`,22 `pluck`/`group` with input.23- **Mass assignment**: missing/loose Strong Parameters (`params.permit!`, `permit(*keys)`).24- **Deserialization**: `YAML.load`(vs `safe_load`), `Marshal.load`, `Oj` in compat mode on input.25- **XSS/SSRF/render**: `.html_safe`/`raw` on user data, `render inline:`/`render text:` with input,26 `open`/`Net::HTTP` on user URLs, `send_file`/`params[:path]` traversal.2728## Framework specifics29- **Rails**: `permit`/`require` correctness, `skip_before_action :verify_authenticity_token` (CSRF),30 `redirect_to params[...]` (open redirect), route globbing exposing actions, secrets in31 `credentials`/ENV, default `protect_from_forgery` disabled on APIs.3233## Method341. Run `brakeman` and `bundler-audit`; triage the warnings (Brakeman is high-signal for Rails).352. `rg 'send\(|constantize|eval|where\(".*#\{|html_safe|YAML.load|render.*inline'` → trace to params.363. Check every controller's strong-params and `before_action` auth coverage.374. Confirm exploitable findings with `web-sqli`, `web-deserialization`, `web-ssrf`, `web-idor`.3839## Gotchas40- `send` to a fixed symbol is fine; the bug is `send(params[:action])`.41- `YAML.safe_load` is safe; plain `YAML.load` on input is RCE-capable.42- Brakeman false positives exist — always confirm the param actually reaches the sink.4344## References45Brakeman docs; Rails Security Guide; OWASP Ruby on Rails cheat sheet.
NoorQureshi