How should I sanitize user input before passing it to% x (its execution)?

Question

I take the input line from the user and use it as parameters for the command line command line.

What is the best way to ensure that this input is "safe"? Aka they did not insert "; cd /; rm -rf" or some other ugliness in the field?

Without any disinfection, I have ...

@query = params[:query]
@result = %x( mycommand #{@query} )

I need to get the output of the command, so I can not use the system ("command", "parameters"), since this returns only true or false, but will provide protection.

I know this is dangerous ... thanks in advance.

Answer 1

, , , . , .

• . mycommand - , . "rm -rf /", 10 000 , .
• / mycommand "", ? 2 , ?

, mycommand, , : ; . , , .

Answer 2

- , , , . , !

Answer 3

, dwc, (im, , ) IP-, Resolv , A/CNAME PTR IP.

IP-, ptr, . , A/CNAME, , .

Answer 4

Another option, if your commands are limited, you can create a list in the drop-down list of commands and put the arguments in other fields / checkboxes / dropldowns. Then confirm each argument as Mike suggests.

This would prevent any user from entering a value from really making it to the command line.