Command injection in Sinatra represents a critical failure in input handling where untrusted data reaches a system shell. Using methods like backticks, `system()`, or `exec()` with string interpolation allows attackers to break out of the intended command using shell metacharacters (`;`, `&`, `|`, `` ` ``) to execute arbitrary code with the privileges of the web process.

The Vulnerable Pattern

require 'sinatra'
get ‘/lookup’ do
DANGEROUS: User input is interpolated directly into a shell command
target = params[:target]
nslookup #{target}
end

The Secure Implementation

To kill command injection, you must move away from shell-invoking strings. The vulnerable example uses backticks, which spawn a subshell and interpret metacharacters. The secure version implements two layers of defense: first, a regex whitelist ensures the input contains only safe characters. Second, it uses `Open3.capture3` passing the command and arguments as separate elements in an array. This triggers direct execution of the binary, bypassing shell interpretation entirely and rendering payload injection impossible.

require 'sinatra'
require 'open3'
get ‘/lookup’ do
target = params[:target]
1. Strict Validation: Whitelist allowed characters
halt 400, ‘Invalid target’ unless target =~ /\A[a-zA-Z0-9.-]+\z/
2. Parameterized Execution: Use Open3.capture3 with an array to bypass the shell
stdout, stderr, status = Open3.capture3(‘nslookup’, target)
if status.success?
content_type :text
stdout
else
halt 500, ‘Lookup failed’
end
end