Review Ruby for send, YAML.load, and mass assignment

Jun 30, 2026 · 1 min read

Ruby metaprogramming and Rails strong parameters are common failure points.

bash

grep -rEn ".send(|public_send(|YAML.load|Marshal.load|constantize|permit!" --include=*.rb .

The bugs invoke arbitrary methods or bind all params.

ruby

obj.send(params[:action])          # call any method
params.require(:user).permit!      # mass assignment of every field

Pro note: constantize and send on request data enable method and class injection; restrict to an allow-list. Prefer YAML.safe_load. In views, watch for html_safe and raw on interpolated data, which reintroduce XSS.