# Code Review Ruby

> Security review of Ruby code — dangerous sinks and Rails pitfalls. Load when reviewing a Ruby/Rails codebase/PR, on .rb source in scope, or "review this Rails app". Signals: Gemfile, config/routes.rb, ActiveRecord, ERB, YAML.load, send/constantize.

- Skill: `noorqureshi/code-review-ruby` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/code-review-ruby`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/code-review-ruby/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/code-review-ruby

---


# Ruby / Rails source review

## When it applies
Reviewing Ruby source, usually Rails. Rails is safe by default in many places, so the bugs cluster
in dynamic dispatch, mass assignment gaps, raw SQL, and unsafe deserialization/rendering.

## Why it works
Ruby's metaprogramming (`send`, `constantize`, `eval`) turns strings into method/class/code
references, and Rails helpers have unsafe escape hatches (`.html_safe`, `where("...#{x}...")`,
`render inline:`). Tracing params to these is the whole game — and Brakeman automates the first pass.

## Sinks & patterns (grep, then trace to user input)
- **Code exec**: `eval`, `instance_eval`, `class_eval`, backticks/`system`/`%x`/`exec`/`open("|…")`.
- **Dynamic dispatch**: `send`/`public_send`/`__send__` with a param method name; `constantize`/
  `safe_constantize` on input (arbitrary class instantiation).
- **SQLi**: string interpolation in `where("name = '#{x}'")`, `find_by_sql`, `order(params[:sort])`,
  `pluck`/`group` with input.
- **Mass assignment**: missing/loose Strong Parameters (`params.permit!`, `permit(*keys)`).
- **Deserialization**: `YAML.load`(vs `safe_load`), `Marshal.load`, `Oj` in compat mode on input.
- **XSS/SSRF/render**: `.html_safe`/`raw` on user data, `render inline:`/`render text:` with input,
  `open`/`Net::HTTP` on user URLs, `send_file`/`params[:path]` traversal.

## Framework specifics
- **Rails**: `permit`/`require` correctness, `skip_before_action :verify_authenticity_token` (CSRF),
  `redirect_to params[...]` (open redirect), route globbing exposing actions, secrets in
  `credentials`/ENV, default `protect_from_forgery` disabled on APIs.

## Method
1. Run `brakeman` and `bundler-audit`; triage the warnings (Brakeman is high-signal for Rails).
2. `rg 'send\(|constantize|eval|where\(".*#\{|html_safe|YAML.load|render.*inline'` → trace to params.
3. Check every controller's strong-params and `before_action` auth coverage.
4. Confirm exploitable findings with `web-sqli`, `web-deserialization`, `web-ssrf`, `web-idor`.

## Gotchas
- `send` to a fixed symbol is fine; the bug is `send(params[:action])`.
- `YAML.safe_load` is safe; plain `YAML.load` on input is RCE-capable.
- Brakeman false positives exist — always confirm the param actually reaches the sink.

## References
Brakeman docs; Rails Security Guide; OWASP Ruby on Rails cheat sheet.