nyx/tests/dynamic_fixtures/ssti/ruby_erb/benign.rb
2026-06-05 10:16:30 -05:00

11 lines
373 B
Ruby

# Phase 04 (Track J.2) — Ruby ERB benign control fixture.
#
# Escapes ERB markers in the body before rendering through a fixed
# template that interpolates only the sanitised value, so SSTI-shaped
# input cannot reach the evaluator.
require 'erb'
def run(body)
safe_body = body.gsub(/<%/, '&lt;%').gsub(/%>/, '%&gt;')
ERB.new('<%= safe_body %>').result(binding)
end