nyx/tests/fixtures/ssti/ruby/safe_erb_constant.rb
2026-05-07 01:29:31 -04:00

10 lines
276 B
Ruby

# Safe: ERB.new receives a constant template source. Local variables
# bound through `binding` may carry user input but do not activate SSTI.
require "erb"
def handler(params)
name = params[:name]
template = ERB.new("Hello, <%= name %>")
template.result(binding)
end