vetkit.ruby.path-traversal.render-template
The template or partial to render is chosen by request input. Attackers can render templates that were never meant to be reachable (and on old Rails, arbitrary files).
Last updated:
Suite: Security
ruby
The template or partial to render is chosen by request input. Attackers can render templates that were never meant to be reachable (and on old Rails, arbitrary files).
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Map the request value to an allow-list of template names before calling render.
References
Source: packages/engine/rules/sast/ruby.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.