A Ruby library for safely running shell commands with proper argument escaping and security protections.
Terrapin is a Ruby gem that provides a secure way to execute shell commands from Ruby code. It solves the problem of shell injection vulnerabilities by automatically escaping user-supplied arguments while offering a clean API for command execution, error handling, and logging.
Ruby developers who need to safely interact with system commands, particularly in web applications or scripts that process user input or external data.
Developers choose Terrapin because it provides robust security against shell injection attacks out of the box, has a simple and intuitive API, and handles cross-platform edge cases that raw shell execution in Ruby doesn't address.
Run shell commands safely, even with user-supplied values
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Terrapin automatically escapes user-supplied values in the 'run' method, preventing shell injection attacks as demonstrated in the README where malicious inputs are safely quoted.
It raises specific exceptions like ExitStatusError for command failures and CommandNotFoundError for missing commands, providing clear feedback without manual status checks.
Supports multiple backends like Process.spawn, backticks, and custom runners, allowing adaptation to different environments, such as JRuby compatibility fixes.
Includes logging for executed commands via logger configuration, aiding in debugging and auditing, as shown with examples of logging to STDOUT.
Terrapin does not escape arguments passed to the 'new' method, requiring developers to strictly avoid user data in templates, which can lead to vulnerabilities if misused.
On older JRuby versions, it may cause errors like Errno::ECHILD or spawn warnings, forcing the use of alternative runners like BackticksRunner as a workaround.
Requires understanding and configuring runners for specific use cases, adding complexity compared to simple Ruby backticks or system calls.