> but ruby doesn't track external strings as dirty like that. It does: irb(main):001:0> gets.tainted? foo => true You can even set $SAFE to 1 or higher

> but ruby doesn't track external strings as dirty like that. It does: irb(main):001:0> gets.tainted? foo => true You can even set $SAFE to 1 or higher to disallow the use of tainted strings in potentially dangerous commands: freya:~ flgr$ ruby -e '$SAFE = 1; system "tar bla bla #{gets}"' foo -e:1:in `system': Insecure operation: -r (SecurityError) from -e:1:in `<main>' See http://phrogz.net/programmingruby/taint.html http://phrogz.net/programmingruby/taint.html for more information.