title: Command injection problem in controller method
body: <p>so im having a problem with a security problem in my code. </p>
  
  <p>Thing is, i wrote some code for placing a button in a form, so when you click it you check some things. So, i have my button which is calling a method called 'test_oid', which is in my controller. This method render a file with the same name and so on. </p>
  
  <p>My problem is in the controller method. This method is called via ajax, and im passing some parameters via ajax to this controller, parameters that im accesing with params[:whatever]. Now, when i push this to my gitlab, i try to merge, its telling me about a vulnerability with some command injection in this method, and its obvious it is related to the params.</p>
  
  <p>I know about the name_object_params, in which you allow which ones you want to use. This is my params method:</p>
  
  <pre><code>def monitor_category_params
      params.require(:monitor_category)
        .permit(:name, :description, :technology, :category, :main_category,
                :impact, :operation, :sensor_types, :default,:oid, :snmp_vars, :snmp_oper,
                :custom_tab_name, :custom_tab_unit, :redfish, :ipmi)
    end
  </code></pre>
  
  <p>But i think this params are used for creating and updating, when you click on the submit button from a form, the thing is that im still inside the form, i havent clicked the submit button yet. </p>
  
  <p>Now, this is my method in the controller:</p>
  
  <pre><code>def test_oid
      oid_result = ''
      sensor_id = nil
      sensor_ip = params[:sensor_ip] || nil
      oid = params[:oid] || nil
      if number?(params[:sensor_id])
        sensor_id = params[:sensor_id]
      end
      community = Sensor.find(sensor_id).snmp_community if !sensor_id.nil?
      if oid and community and sensor_ip
        oid_result = `whatever`
      end
      if request.xhr?
        render json: {result: oid_result}, :layout =&gt; false
      end
    end
  </code></pre>
  
  <p>and this is the call to this method from ajax:</p>
  
  <pre><code>$.ajax({
         url: "/monitor/test_oid",
         type: 'GET',
         dataType: 'json',
         data: {oid: valor, sensor_id: sensor_id, sensor_ip: sensor_ip}
       })
  </code></pre>
  
  <p>where im passing the variables that im using later with the params. </p>
  
  <p>So, what is the problem here? The code works and all, but there is this security problem, in which i guess people can inject code with the params, but since the params im working with come from ajax, what is the problem? Thank you for the answers, im very new to this language and im still trying to understand the magic.</p>
  
  <p>This the error that the test returns.</p>
  
  <pre><code>+SECURITY WARNINGS+
  
  +------------+-------------------+----------+-------------------+-------------&gt;&gt;
  | Confidence | Class             | Method   | Warning Type      | Message     &gt;&gt;
  +------------+-------------------+----------+-------------------+-------------&gt;&gt;
  | High       | MonitorController | test_oid | Command Injection | Possible com&gt;&gt;
  +------------+-------------------+----------+-------------------+-------------&gt;&gt;
  </code></pre>
  
  <p>edit: as proposed, i used open3.capture2 instead of the backticks so now my code is like this:</p>
  
  <pre><code>def test_oid
      oid_result = ''
      sensor_id = nil
      sensor_ip = params[:sensor_ip] || nil
      oid = params[:oid] || nil
      if number?(params[:sensor_id])
        sensor_id = params[:sensor_id]
      end
      community = Sensor.find(sensor_id).snmp_community if !sensor_id.nil?
      if oid and community and sensor_ip
        # We use Open3.capture2 to skip a command injection security problem.
        oid_result = Open3.capture2('nice', '-n', '19', 'snmpbulkwalk', '-v', '2c', '-c', community, sensor_ip, oid)
        oid_result2 = `echo "#{oid_result.first}" | awk '/kB$/{ $(NF-1)= $(NF-1)*1024;} {print $0}'  | sed 's/ [A-Za-z]*$//' | awk '{print $NF}' | grep -o '[[:digit:]]*' | paste -s -d';' -`
      end
      if request.xhr?
        render json: {result: oid_result2}, :layout =&gt; false
      end
    end
  </code></pre>
  
  <p>now the test are giving me 2 errors of command injection. </p>