The following code includes a command and a string:
files = `ls /tmp`
I would like /tmp to be a variable instead of a static string, and would ideally like it to be like:
dir = '/tmp'
command = 'ls ' + dir
files = `command`
What is the correct Ruby syntax to achieve this?
Use string interpolation:
dir = '/tmp'
files = `ls #{dir}`
files = `#{command}`
Is that what you are looking for ?
Use the standard shellwords library. It will take care of proper escaping, which will help to protect you from shell injection attacks.
require 'shellwords'
command = [
'ls',
dir
].shelljoin
files = `#{command}`
If dir comes from untrusted input, the above code still allows someone to see any directory on your system. However, using shelljoin protects you from someone injecting, for example, a "delete all files on my hard drive" command.
In the particular case of listing a directory, The built-in class Dir will do that rather well:
files = Dir[File.join(dir, '*')]
Here we add a glob onto the end of the directory using File::join. Dir::[] then returns the paths of the files in that directory.
