Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
ID: ruby-security/rails-avoid-constantize
Language: Ruby
Severity: Info
Category: Best Practices
Description
The rule “Avoid constantize” advises against the use of constantize and safe_constantize methods in Ruby. These methods are used to convert a string into a constant, but they pose a significant security risk.
The constantize method can be exploited to run arbitrary code in your application, which makes it a potential target for code injection attacks. For example, a malicious user could manipulate the string to reference a class that performs destructive actions when loaded.
Instead of using constantize or safe_constantize, explicitly reference the constant you need. If you have a limited set of constants you want to access based on a string, consider using a hash or case statement to map strings to constants. This gives you control over which constants are accessible, and prevents arbitrary constants from being referenced.
In general, it’s best to avoid methods that can execute code based on user input or other untrusted sources. Always prioritize secure coding practices to maintain the integrity and safety of your application.
Learn More
Non-Compliant Code Examples
"Module".constantize
"Class".safe_constantize
