noorqureshi/security-skills/code-review-ruby

Ruby / Rails source review

When it applies

Reviewing Ruby source, usually Rails. Rails is safe by default in many places, so the bugs cluster in dynamic dispatch, mass assignment gaps, raw SQL, and unsafe deserialization/rendering.

Why it works

Ruby's metaprogramming (send, constantize, eval) turns strings into method/class/code references, and Rails helpers have unsafe escape hatches (.html_safe, where("...#{x}..."), render inline:). Tracing params to these is the whole game — and Brakeman automates the first pass.

Sinks & patterns (grep, then trace to user input)

• Code exec: eval, instance_eval, class_eval, backticks/system/%x/exec/open("|…").
• Dynamic dispatch: send/public_send/__send__ with a param method name; constantize/

safe_constantize on input (arbitrary class instantiation).

• SQLi: string interpolation in where("name = '#{x}'"), find_by_sql, order(params[:sort]),

pluck/group with input.

• Mass assignment: missing/loose Strong Parameters (params.permit!, permit(*keys)).
• Deserialization: YAML.load(vs safe_load), Marshal.load, Oj in compat mode on input.
• XSS/SSRF/render: .html_safe/raw on user data, render inline:/render text: with input,

open/Net::HTTP on user URLs, send_file/params[:path] traversal.

Framework specifics

• Rails: permit/require correctness, skip_before_action :verify_authenticity_token (CSRF),

redirect_to params[...] (open redirect), route globbing exposing actions, secrets in credentials/ENV, default protect_from_forgery disabled on APIs.

Method

1. Run brakeman and bundler-audit; triage the warnings (Brakeman is high-signal for Rails).
2. rg 'send\(|constantize|eval|where\(".*#\{|html_safe|YAML.load|render.*inline' → trace to params.
3. Check every controller's strong-params and before_action auth coverage.
4. Confirm exploitable findings with web-sqli, web-deserialization, web-ssrf, web-idor.

Gotchas

• send to a fixed symbol is fine; the bug is send(params[:action]).
• YAML.safe_load is safe; plain YAML.load on input is RCE-capable.
• Brakeman false positives exist — always confirm the param actually reaches the sink.

References

Brakeman docs; Rails Security Guide; OWASP Ruby on Rails cheat sheet.