summaryrefslogtreecommitdiff
path: root/doc/command_injection.rdoc
diff options
context:
space:
mode:
Diffstat (limited to 'doc/command_injection.rdoc')
-rw-r--r--doc/command_injection.rdoc37
1 files changed, 0 insertions, 37 deletions
diff --git a/doc/command_injection.rdoc b/doc/command_injection.rdoc
deleted file mode 100644
index ee33d4a04e..0000000000
--- a/doc/command_injection.rdoc
+++ /dev/null
@@ -1,37 +0,0 @@
-= Command Injection
-
-Some Ruby core methods accept string data
-that includes text to be executed as a system command.
-
-They should not be called with unknown or unsanitized commands.
-
-These methods include:
-
-- Kernel.exec
-- Kernel.spawn
-- Kernel.system
-- {\`command` (backtick method)}[rdoc-ref:Kernel#`]
- (also called by the expression <tt>%x[command]</tt>).
-- IO.popen (when called with other than <tt>"-"</tt>).
-
-Some methods execute a system command only if the given path name starts
-with a <tt>|</tt>:
-
-- Kernel.open(command).
-- IO.read(command).
-- IO.write(command).
-- IO.binread(command).
-- IO.binwrite(command).
-- IO.readlines(command).
-- IO.foreach(command).
-- URI.open(command).
-
-Note that some of these methods do not execute commands when called
-from subclass +File+:
-
-- File.read(path).
-- File.write(path).
-- File.binread(path).
-- File.binwrite(path).
-- File.readlines(path).
-- File.foreach(path).