Cette page n'est pas encore disponible en français, sa traduction est en cours. Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.
Metadata
ID:ruby-security/no-eval
Language: Ruby
Severity: Info
Category: Security
Description
The eval method in Ruby is used to execute a string of code at runtime, essentially treating it as a part of the program. While powerful, it exposes your code to significant security risks, as it can execute any code it’s given. This includes potentially harmful code that can alter or delete data, or interact with the system on which your Ruby program is running.
The use of eval is considered a bad practice because it can lead to code injection attacks. An attacker can inject malicious code into the string that eval will execute. This can lead to a variety of security vulnerabilities, such as unauthorized access to sensitive data, corruption of data, or even taking control of the entire system.
Instead of using eval, consider using safer alternatives like send or public_send. These methods allow you to call methods dynamically on objects without the security risks associated with eval. If you need to execute dynamically generated code, consider using the RubyVM::InstructionSequence class, which can compile and execute code in a safer manner. Always validate and sanitize any user input that will be used in these methods to prevent code injection attacks.
