nyx/tests/fixtures/ssti/ruby/safe_erb_template_var.rb
2026-05-07 01:29:31 -04:00

8 lines
328 B
Ruby

# Safe-template-var: render an on-disk template via Rails-style
# `render :template, locals: {...}`. The template name is a constant
# symbol; the locals carry user input but flow into a file-loaded
# template, not into a source string.
def handler(params)
render template: "users/show", locals: { name: params[:name] }
end