Ruby Shell Command Injection

# SECURE: Using array arguments to avoid shell interpretation
def backup_file_safe(filename)
  # Validate filename first
  raise ArgumentError, "Invalid filename" unless valid_filename?(filename)
  
  source_path = File.join('/app/uploads', filename)
  backup_path = File.join('/app/backups', "#{filename}.bak")
  
  # Ensure paths exist and are safe
  raise ArgumentError, "Source file not found" unless File.exist?(source_path)
  raise SecurityError, "Path traversal detected" unless safe_path?(source_path)
  
  # SECURE: Use array arguments (no shell interpretation)
  success = system('cp', source_path, backup_path)
  
  unless success
    raise RuntimeError, "Backup operation failed"
  end
  
  backup_path
end

def ping_host_safe(hostname)
  # Comprehensive hostname validation
  raise ArgumentError, "Invalid hostname" unless valid_hostname?(hostname)
  
  # SECURE: Array arguments prevent injection
  success = system('ping', '-c', '1', '-W', '5', hostname)
  
  return success
end

def get_file_info_safe(filepath)
  # Validate and sanitize file path
  raise ArgumentError, "Invalid filepath" unless valid_filepath?(filepath)
  
  safe_path = File.join('/app/data', File.basename(filepath))
  raise ArgumentError, "File not found" unless File.exist?(safe_path)
  
  # SECURE: Use IO.popen with array to avoid shell
  IO.popen(['ls', '-la', safe_path]) do |pipe|
    pipe.read
  end
end

# Helper validation methods
def valid_filename?(filename)
  return false if filename.nil? || filename.empty?
  return false if filename.length > 255
  return false unless filename.match?(/\A[a-zA-Z0-9._-]+\z/)
  return false if filename.include?('..') || filename.start_with?('.')
  true
end

def valid_hostname?(hostname)
  return false if hostname.nil? || hostname.empty?
  return false if hostname.length > 253
  # RFC compliant hostname pattern
  pattern = /\A[a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?)*\z/
  hostname.match?(pattern)
end

def valid_filepath?(filepath)
  return false if filepath.nil? || filepath.empty?
  return false if filepath.include?('..')
  return false unless filepath.match?(/\A[a-zA-Z0-9._\/-]+\z/)
  true
end

def safe_path?(path)
  # Ensure path is within allowed directories
  allowed_dirs = ['/app/uploads', '/app/data', '/tmp/safe']
  real_path = File.realpath(path)
  
  allowed_dirs.any? { |dir| real_path.start_with?(File.realpath(dir)) }
rescue Errno::ENOENT
  false
end

# SECURE: Comprehensive input validation framework
module InputValidator
  # Filename validation with strict allowlist
  def self.validate_filename(filename)
    errors = []
    
    if filename.nil? || filename.strip.empty?
      errors << "Filename cannot be empty"
      return errors
    end
    
    filename = filename.strip
    
    # Length validation
    errors << "Filename too long (max 255 characters)" if filename.length > 255
    errors << "Filename too short (min 1 character)" if filename.length < 1
    
    # Character allowlist validation
    unless filename.match?(/\A[a-zA-Z0-9._-]+\z/)
      errors << "Filename contains invalid characters (allowed: a-z, A-Z, 0-9, ., _, -)"
    end
    
    # Security checks
    errors << "Filename cannot contain path traversal sequences" if filename.include?("..")
    errors << "Filename cannot start with dot" if filename.start_with?(".")
    errors << "Filename cannot be only dots" if filename.match?(/\A\.+\z/)
    
    # Extension validation
    allowed_extensions = %w[.txt .csv .json .xml .log .pdf .jpg .png .gif]
    extension = File.extname(filename).downcase
    unless allowed_extensions.include?(extension)
      errors << "File extension not allowed (#{extension})"
    end
    
    errors
  end
  
  # Hostname validation with comprehensive checks
  def self.validate_hostname(hostname)
    errors = []
    
    if hostname.nil? || hostname.strip.empty?
      errors << "Hostname cannot be empty"
      return errors
    end
    
    hostname = hostname.strip.downcase
    
    # Length validation
    errors << "Hostname too long (max 253 characters)" if hostname.length > 253
    
    # Format validation - RFC compliant
    hostname_pattern = /\A[a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?)*\z/
    unless hostname.match?(hostname_pattern)
      errors << "Invalid hostname format"
    end
    
    # Additional security checks
    errors << "Hostname cannot contain control characters" if hostname.match?(/[\x00-\x1f\x7f]/)
    
    # Check for suspicious patterns
    suspicious_patterns = [
      /[;&|`$(){}\[\]<>"'\\]/, # Shell metacharacters
      /\s/,                    # Whitespace
      /localhost/i,            # Localhost variations
      /127\.0\.0\.1/,          # Loopback IP
      /0\.0\.0\.0/,            # Any IP
    ]
    
    suspicious_patterns.each do |pattern|
      errors << "Hostname contains suspicious patterns" if hostname.match?(pattern)
    end
    
    errors
  end
  
  # Path validation with traversal protection
  def self.validate_path(path, allowed_base_dirs = [])
    errors = []
    
    if path.nil? || path.strip.empty?
      errors << "Path cannot be empty"
      return errors
    end
    
    path = path.strip
    
    # Basic format validation
    unless path.match?(/\A[a-zA-Z0-9._\/-]+\z/)
      errors << "Path contains invalid characters"
    end
    
    # Path traversal checks
    errors << "Path traversal detected" if path.include?("..")
    errors << "Absolute path not allowed" if path.start_with?("/") && allowed_base_dirs.empty?
    
    # Check against allowed directories
    unless allowed_base_dirs.empty?
      begin
        real_path = File.realpath(path)
        allowed = allowed_base_dirs.any? do |base_dir|
          real_base = File.realpath(base_dir)
          real_path.start_with?(real_base)
        end
        
        errors << "Path not in allowed directory" unless allowed
      rescue Errno::ENOENT
        errors << "Path does not exist"
      rescue StandardError => e
        errors << "Path validation error: #{e.message}"
      end
    end
    
    errors
  end
  
  # Command validation with strict allowlist
  def self.validate_command(command)
    errors = []
    
    if command.nil? || command.strip.empty?
      errors << "Command cannot be empty"
      return errors
    end
    
    command = command.strip
    
    # Allowlist of permitted commands
    allowed_commands = %w[
      ping ls cat grep find file du df tar gzip gunzip
      convert identify ffmpeg ffprobe curl wget
    ]
    
    # Extract command name (first word)
    command_name = command.split.first
    
    unless allowed_commands.include?(command_name)
      errors << "Command not in allowlist: #{command_name}"
    end
    
    # Check for shell metacharacters
    shell_chars = /[;&|`$(){}\[\]<>"'\\]/
    if command.match?(shell_chars)
      errors << "Command contains shell metacharacters"
    end
    
    errors
  end
  
  # Numeric parameter validation
  def self.validate_integer(value, min: nil, max: nil)
    errors = []
    
    # Type conversion and validation
    begin
      int_value = Integer(value)
    rescue ArgumentError, TypeError
      errors << "Value must be a valid integer"
      return errors
    end
    
    # Range validation
    errors << "Value too small (minimum: #{min})" if min && int_value < min
    errors << "Value too large (maximum: #{max})" if max && int_value > max
    
    errors
  end
end

# Usage example with comprehensive validation
class SecureFileManager
  def self.backup_file(filename)
    # Validate input
    validation_errors = InputValidator.validate_filename(filename)
    raise ArgumentError, validation_errors.join(", ") unless validation_errors.empty?
    
    # Additional business logic validation
    source_path = File.join('/app/uploads', filename)
    raise ArgumentError, "Source file not found" unless File.exist?(source_path)
    
    path_errors = InputValidator.validate_path(source_path, ['/app/uploads'])
    raise SecurityError, path_errors.join(", ") unless path_errors.empty?
    
    # Proceed with secure operation
    backup_path = File.join('/app/backups', "#{filename}.bak")
    success = system('cp', source_path, backup_path)
    
    raise RuntimeError, "Backup failed" unless success
    
    backup_path
  end
end

require 'fileutils'
require 'net/http'
require 'uri'
require 'digest'
require 'zlib'
require 'json'
require 'csv'

# SECURE: Using Ruby libraries instead of system commands
class SecureOperations
  # File operations using Ruby's FileUtils instead of system cp/mv
  def self.copy_file_safe(source_filename, dest_filename)
    # Validate inputs
    validate_filename(source_filename)
    validate_filename(dest_filename)
    
    source_path = safe_path('/app/uploads', source_filename)
    dest_path = safe_path('/app/backups', dest_filename)
    
    # Ensure source exists
    raise ArgumentError, "Source file not found" unless File.exist?(source_path)
    
    # Use Ruby's FileUtils instead of system cp
    FileUtils.copy_file(source_path, dest_path, preserve: true)
    
    # Verify copy was successful
    unless File.exist?(dest_path) && File.size(source_path) == File.size(dest_path)
      raise RuntimeError, "File copy verification failed"
    end
    
    dest_path
  end
  
  # File analysis using Ruby's File class instead of system file command
  def self.analyze_file_safe(filename)
    validate_filename(filename)
    
    file_path = safe_path('/app/uploads', filename)
    raise ArgumentError, "File not found" unless File.exist?(file_path)
    
    # Use Ruby's built-in file methods
    stat = File.stat(file_path)
    
    {
      filename: File.basename(file_path),
      size: stat.size,
      size_human: humanize_bytes(stat.size),
      permissions: sprintf("%o", stat.mode)[-4..-1],
      owner: stat.uid,
      group: stat.gid,
      created: stat.ctime.iso8601,
      modified: stat.mtime.iso8601,
      accessed: stat.atime.iso8601,
      mime_type: guess_mime_type(file_path),
      md5_hash: calculate_file_hash(file_path, 'md5'),
      sha256_hash: calculate_file_hash(file_path, 'sha256')
    }
  end
  
  # Network operations using Ruby's Net::HTTP instead of curl/wget
  def self.download_file_safe(url, filename)
    # Validate URL
    uri = URI.parse(url)
    raise ArgumentError, "Invalid URL scheme" unless ['http', 'https'].include?(uri.scheme)
    raise ArgumentError, "Invalid hostname" unless valid_hostname?(uri.host)
    
    validate_filename(filename)
    
    output_path = safe_path('/app/downloads', filename)
    
    # Use Ruby's Net::HTTP instead of system wget/curl
    Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == 'https') do |http|
      http.request_get(uri.path || '/') do |response|
        raise RuntimeError, "HTTP error: #{response.code}" unless response.code == '200'
        
        # Check content length
        content_length = response['content-length']
        if content_length && content_length.to_i > 100 * 1024 * 1024 # 100MB limit
          raise RuntimeError, "File too large: #{content_length} bytes"
        end
        
        File.open(output_path, 'wb') do |file|
          response.read_body do |chunk|
            file.write(chunk)
            
            # Check file size while writing
            if file.size > 100 * 1024 * 1024
              file.close
              File.delete(output_path)
              raise RuntimeError, "Download size limit exceeded"
            end
          end
        end
      end
    end
    
    output_path
  end
  
  # Compression using Ruby's Zlib instead of system gzip
  def self.compress_file_safe(filename)
    validate_filename(filename)
    
    input_path = safe_path('/app/uploads', filename)
    output_path = safe_path('/app/compressed', "#{filename}.gz")
    
    raise ArgumentError, "Input file not found" unless File.exist?(input_path)
    
    # Use Ruby's Zlib for compression
    Zlib::GzipWriter.open(output_path) do |gz|
      File.open(input_path, 'rb') do |input|
        while chunk = input.read(8192)
          gz.write(chunk)
        end
      end
    end
    
    output_path
  end
  
  # Directory listing using Ruby's Dir instead of system ls
  def self.list_directory_safe(dirname)
    # Validate directory name
    raise ArgumentError, "Invalid directory name" unless dirname.match?(/\A[a-zA-Z0-9._-]+\z/)
    
    dir_path = safe_path('/app/data', dirname)
    raise ArgumentError, "Directory not found" unless Dir.exist?(dir_path)
    
    # Use Ruby's Dir class instead of system ls
    entries = Dir.entries(dir_path).reject { |entry| entry.start_with?('.') }
    
    entries.map do |entry|
      entry_path = File.join(dir_path, entry)
      stat = File.stat(entry_path)
      
      {
        name: entry,
        type: File.directory?(entry_path) ? 'directory' : 'file',
        size: stat.size,
        modified: stat.mtime.iso8601,
        permissions: sprintf("%o", stat.mode)[-4..-1]
      }
    end
  end
  
  # Text processing using Ruby instead of system grep/awk
  def self.search_in_file_safe(filename, pattern)
    validate_filename(filename)
    
    # Validate search pattern
    raise ArgumentError, "Search pattern too long" if pattern.length > 1000
    raise ArgumentError, "Invalid search pattern" unless pattern.match?(/\A[a-zA-Z0-9\s._-]+\z/)
    
    file_path = safe_path('/app/data', filename)
    raise ArgumentError, "File not found" unless File.exist?(file_path)
    
    results = []
    line_number = 0
    
    # Use Ruby's file reading instead of system grep
    File.foreach(file_path) do |line|
      line_number += 1
      
      if line.include?(pattern)
        results << {
          line_number: line_number,
          content: line.strip,
          match_position: line.index(pattern)
        }
      end
      
      # Prevent memory exhaustion
      break if results.length > 1000
    end
    
    results
  end
  
  private
  
  def self.validate_filename(filename)
    errors = InputValidator.validate_filename(filename)
    raise ArgumentError, errors.join(", ") unless errors.empty?
  end
  
  def self.valid_hostname?(hostname)
    return false if hostname.nil? || hostname.empty?
    hostname.match?(/\A[a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?)*\z/)
  end
  
  def self.safe_path(base_dir, filename)
    path = File.join(base_dir, filename)
    real_path = File.realpath(File.dirname(path))
    real_base = File.realpath(base_dir)
    
    unless real_path.start_with?(real_base)
      raise SecurityError, "Path traversal detected: #{filename}"
    end
    
    path
  end
  
  def self.humanize_bytes(bytes)
    units = %w[B KB MB GB TB]
    size = bytes.to_f
    unit_index = 0
    
    while size >= 1024 && unit_index < units.length - 1
      size /= 1024
      unit_index += 1
    end
    
    "%.2f #{units[unit_index]}" % size
  end
  
  def self.guess_mime_type(file_path)
    # Simple MIME type guessing based on extension
    extension = File.extname(file_path).downcase
    
    mime_types = {
      '.txt' => 'text/plain',
      '.json' => 'application/json',
      '.xml' => 'application/xml',
      '.csv' => 'text/csv',
      '.jpg' => 'image/jpeg',
      '.jpeg' => 'image/jpeg',
      '.png' => 'image/png',
      '.gif' => 'image/gif',
      '.pdf' => 'application/pdf'
    }
    
    mime_types[extension] || 'application/octet-stream'
  end
  
  def self.calculate_file_hash(file_path, algorithm)
    digest_class = case algorithm.downcase
                   when 'md5' then Digest::MD5
                   when 'sha256' then Digest::SHA256
                   else raise ArgumentError, "Unsupported hash algorithm: #{algorithm}"
                   end
    
    digest = digest_class.new
    
    File.open(file_path, 'rb') do |file|
      while chunk = file.read(8192)
        digest.update(chunk)
      end
    end
    
    digest.hexdigest
  end
end

# Usage examples:
# SecureOperations.copy_file_safe('document.pdf', 'document_backup.pdf')
# SecureOperations.analyze_file_safe('data.csv')
# SecureOperations.download_file_safe('https://example.com/file.txt', 'downloaded.txt')

require 'timeout'
require 'tempfile'
require 'fileutils'

# SECURE: Sandboxed process execution with comprehensive security controls
class SandboxedExecutor
  DEFAULT_TIMEOUT = 30 # seconds
  MAX_OUTPUT_SIZE = 10 * 1024 * 1024 # 10MB
  MAX_MEMORY_USAGE = 128 * 1024 * 1024 # 128MB
  
  # Allowlist of permitted commands
  ALLOWED_COMMANDS = %w[
    ping ls cat grep find file du df
    tar gzip gunzip convert identify
    ffmpeg ffprobe
  ].freeze
  
  def initialize(options = {})
    @timeout = options[:timeout] || DEFAULT_TIMEOUT
    @max_output_size = options[:max_output_size] || MAX_OUTPUT_SIZE
    @working_dir = options[:working_dir] || create_sandbox_directory
    @restricted_env = create_restricted_environment
  end
  
  def execute_command(command, args = [], options = {})
    # Validate command is allowed
    raise SecurityError, "Command not allowed: #{command}" unless ALLOWED_COMMANDS.include?(command)
    
    # Validate arguments
    validated_args = validate_arguments(args)
    
    # Build full command array
    full_command = [command] + validated_args
    
    # Execute with comprehensive monitoring
    execute_with_monitoring(full_command, options)
  ensure
    cleanup_sandbox
  end
  
  private
  
  def validate_arguments(args)
    validated = []
    
    args.each do |arg|
      # Basic type check
      raise ArgumentError, "Arguments must be strings" unless arg.is_a?(String)
      
      # Length limit
      raise ArgumentError, "Argument too long" if arg.length > 1000
      
      # Character validation - no control characters
      raise ArgumentError, "Argument contains invalid characters" if arg.match?(/[\x00-\x1f\x7f]/)
      
      # No shell metacharacters
      raise SecurityError, "Argument contains shell metacharacters" if arg.match?(/[;&|`$(){}\[\]<>"'\\]/)
      
      validated << arg
    end
    
    validated
  end
  
  def execute_with_monitoring(command, options)
    result = {
      stdout: '',
      stderr: '',
      exit_code: -1,
      success: false,
      execution_time: 0,
      terminated_by_timeout: false,
      terminated_by_limits: false
    }
    
    start_time = Time.now
    
    begin
      Timeout::timeout(@timeout) do
        # Create pipes for communication
        stdout_r, stdout_w = IO.pipe
        stderr_r, stderr_w = IO.pipe
        
        # Spawn process with restricted environment
        pid = Process.spawn(
          @restricted_env,
          *command,
          chdir: @working_dir,
          out: stdout_w,
          err: stderr_w,
          close_others: true,
          pgroup: true # Create process group for easier cleanup
        )
        
        # Close write ends of pipes
        stdout_w.close
        stderr_w.close
        
        # Monitor process with resource limits
        stdout_thread = Thread.new { read_with_limits(stdout_r) }
        stderr_thread = Thread.new { read_with_limits(stderr_r) }
        
        # Wait for process completion while monitoring resources
        _, status = Process.wait2(pid)
        
        result[:stdout] = stdout_thread.value
        result[:stderr] = stderr_thread.value
        result[:exit_code] = status.exitstatus
        result[:success] = status.success?
        
      end
    rescue Timeout::Error
      # Timeout exceeded - kill process group
      begin
        Process.kill('TERM', -pid) if pid
        sleep(1)
        Process.kill('KILL', -pid) if pid
      rescue Errno::ESRCH
        # Process already dead
      end
      
      result[:terminated_by_timeout] = true
      result[:stderr] = "Process terminated due to timeout (#{@timeout}s)"
      
    rescue StandardError => e
      result[:stderr] = "Execution error: #{e.message}"
      
    ensure
      result[:execution_time] = Time.now - start_time
    end
    
    result
  end
  
  def read_with_limits(io)
    output = ''
    
    while line = io.gets
      output << line
      
      # Check output size limit
      if output.length > @max_output_size
        output << "\n[OUTPUT TRUNCATED - SIZE LIMIT EXCEEDED]\n"
        break
      end
    end
    
    output
  rescue IOError
    output
  ensure
    io.close
  end
  
  def create_sandbox_directory
    # Create temporary sandbox directory
    sandbox_base = '/tmp/ruby_sandbox'
    FileUtils.mkdir_p(sandbox_base) unless Dir.exist?(sandbox_base)
    
    sandbox_name = "sandbox_#{Process.pid}_#{Time.now.to_i}_#{Random.rand(1000)}"
    sandbox_path = File.join(sandbox_base, sandbox_name)
    
    FileUtils.mkdir_p(sandbox_path)
    
    # Set restrictive permissions
    File.chmod(0700, sandbox_path)
    
    sandbox_path
  end
  
  def create_restricted_environment
    {
      'PATH' => '/usr/bin:/bin:/usr/local/bin',
      'HOME' => @working_dir,
      'TMPDIR' => @working_dir,
      'USER' => 'sandbox',
      'SHELL' => '/bin/sh',
      'LANG' => 'C',
      'LC_ALL' => 'C'
    }
  end
  
  def cleanup_sandbox
    return unless @working_dir && Dir.exist?(@working_dir)
    
    begin
      # Recursively remove sandbox directory
      FileUtils.remove_entry_secure(@working_dir)
    rescue StandardError => e
      # Log cleanup failure but don't raise
      warn "Failed to cleanup sandbox directory #{@working_dir}: #{e.message}"
    end
  end
end

# Secure wrapper for common operations
class SecureCommandOperations
  def self.ping_host(hostname, count = 1)
    # Validate hostname
    errors = InputValidator.validate_hostname(hostname)
    raise ArgumentError, errors.join(", ") unless errors.empty?
    
    # Validate count
    count_errors = InputValidator.validate_integer(count, min: 1, max: 10)
    raise ArgumentError, count_errors.join(", ") unless count_errors.empty?
    
    executor = SandboxedExecutor.new(timeout: 15)
    result = executor.execute_command('ping', ['-c', count.to_s, '-W', '5', hostname])
    
    {
      success: result[:success],
      output: result[:stdout],
      error: result[:stderr],
      execution_time: result[:execution_time]
    }
  end
  
  def self.get_file_info(filename)
    # Validate filename
    errors = InputValidator.validate_filename(filename)
    raise ArgumentError, errors.join(", ") unless errors.empty?
    
    safe_path = File.join('/app/uploads', filename)
    raise ArgumentError, "File not found" unless File.exist?(safe_path)
    
    executor = SandboxedExecutor.new(timeout: 10)
    result = executor.execute_command('file', ['--mime-type', '--brief', safe_path])
    
    {
      success: result[:success],
      mime_type: result[:stdout].strip,
      error: result[:stderr],
      execution_time: result[:execution_time]
    }
  end
  
  def self.compress_directory(dirname)
    # Validate directory name
    raise ArgumentError, "Invalid directory name" unless dirname.match?(/\A[a-zA-Z0-9._-]+\z/)
    
    source_dir = File.join('/app/data', dirname)
    raise ArgumentError, "Directory not found" unless Dir.exist?(source_dir)
    
    output_file = "#{dirname}_#{Time.now.to_i}.tar.gz"
    output_path = File.join('/app/compressed', output_file)
    
    executor = SandboxedExecutor.new(timeout: 120) # Longer timeout for compression
    result = executor.execute_command('tar', [
      '-czf', output_path,
      '-C', File.dirname(source_dir),
      File.basename(source_dir)
    ])
    
    {
      success: result[:success],
      output_file: result[:success] ? output_file : nil,
      error: result[:stderr],
      execution_time: result[:execution_time]
    }
  end
end

# Usage examples with error handling
begin
  result = SecureCommandOperations.ping_host('google.com', 3)
  puts "Ping #{result[:success] ? 'successful' : 'failed'}"
  puts result[:output] if result[:success]
  puts result[:error] unless result[:error].empty?
rescue ArgumentError => e
  puts "Validation error: #{e.message}"
rescue SecurityError => e
  puts "Security error: #{e.message}"
rescue StandardError => e
  puts "Execution error: #{e.message}"
end