# Potential command injection in `Shell#[]` and `Shell#test`

Ruby's Shell#[] and Shell#test forward to FileTest via send, letting a crafted method name like 'system' run a subshell command.

- Payout: hidden
- Severity: none
- Program: Ruby
- Found by: ooooooo_q
- Disclosed: 2019-10-16
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/327512
- Library page: https://bugbountylibrary.com/r/h1%3A327512
- Tags: area:oss domain:oss impact:rce kind:bounty platform:hackerone tech:ruby technique:source-review vuln:command-injection

**Target:** Ruby Shell class (Shell#[] / Shell#test)
**Root cause:** Shell#[] and Shell#test use send to dispatch to FileTest methods, so arbitrary method names (including private ones like system) can be invoked instead of only file-test predicates.
**Steps:**
1. Start irb and `require 'shell'`
2. Create `sh = Shell.new`
3. Call `sh['system', '$(touch xy)']`
4. Observe the subshell executes and `ls xy` now shows the created file
**How found:** Noticed that Shell#test/[] delegate via send to FileTest, meaning private methods are reachable; tried 'system' with a subshell payload after finding instance_eval/open blocked by the absolute-path conversion.
**Exploitation:** Attacker who controls the method-name argument to Shell#[] passes 'system' with a command-substitution payload; the path is converted to an absolute path first, but a subshell `$(...)` still executes the embedded command.
**Insight:** When a wrapper uses send to forward to a class like FileTest, enumerate reachable private methods (system, exec, open) rather than assuming only predicate methods are callable; absolute-path normalization may block some sinks but not subshell expansion.