Using contracts.Ruby to avoid file access vulnerabilities

files_controller.rb

Contract String => PathUnder["/allowed/path"]
def safe_path(path)
  "/allowed/path" + path
end

path_under.rb

class PathUnder < CallableClass
  def initialize(parent)
    @parent = parent
  end

  def valid?(path)
    File.expand_path(path) =~ /^#{@parent}/
  end

  def to_s
    "path to be under #{@parent}"
  end
end