class

Flaw::CommandInjection

Inherits Flaw::AstRule < Flaw::Rule < Reference < Object

FLAW001 — AST-backed. Fires when system, backticks, or Process.run receive an argument that is a Crystal::StringInterpolation (i.e., a double-quoted string with #{…}). Passing argv as an array to Process.run does not parse through a shell and does not fire.

Constants

SHELL_CALLS = {"system", "`", "exec"}

Instance methods

default_severity
Source
description
Source
title
Source
visit(node, source : String, path : String, findings : Array(Finding)) : Nil
Source