# Can the .read method execute any files?

**URL:** <https://www.ruby-forum.com/t/can-the-read-method-execute-any-files/185916>\
**Category:** Rails\
**Created:** [March 29, 2010, 9:18am UTC](https://www.ruby-forum.com/t/can-the-read-method-execute-any-files/185916 "2010-03-29T09:18:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![GoodGets](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/439d5e/32.png) [@GoodGets](https://www.ruby-forum.com/u/GoodGets)\
**Post date:** [March 29, 2010, 9:18am UTC](https://www.ruby-forum.com/t/can-the-read-method-execute-any-files/185916/1 "2010-03-29T09:18:57Z")

</div>

I need to read (and parse) a user uploaded file. I check it’s MIME  
types, as well to see if includes proper headers by reading the file,  
but I was wondering can something like params[:uploaded\_file].read  
trigger any EXEs or ruby/php/etc files? Or, is “read” good to go?

---

<div class="post-metadata">

**Author:** ![GoodGets](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/439d5e/32.png) [@GoodGets](https://www.ruby-forum.com/u/GoodGets)\
**Post date:** [March 29, 2010, 9:57am UTC](https://www.ruby-forum.com/t/can-the-read-method-execute-any-files/185916/2 "2010-03-29T09:57:35Z")

</div>

On Mar 29, 8:17 am, GoodGets [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> I need to read (and parse) a user uploaded file. I check it’s MIME  
> types, as well to see if includes proper headers by reading the file,  
> but I was wondering can something like params[:uploaded\_file].read  
> trigger any EXEs or ruby/php/etc files? Or, is “read” good to go?

read does just return the bytes in the IO stream to you - it doesn’t  
do anything with them.

Fred

---

<div class="post-metadata">

**Author:** ![GoodGets](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/439d5e/32.png) [@GoodGets](https://www.ruby-forum.com/u/GoodGets)\
**Post date:** [March 29, 2010, 6:33pm UTC](https://www.ruby-forum.com/t/can-the-read-method-execute-any-files/185916/3 "2010-03-29T18:33:54Z")

</div>

If you are planning on just uploading the file and you don’t want to  
upload executable files you should check for that before allowing the  
upload.

---

<div class="post-metadata">

**Author:** ![GoodGets](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/439d5e/32.png) [@GoodGets](https://www.ruby-forum.com/u/GoodGets)\
**Post date:** [March 30, 2010, 2:16am UTC](https://www.ruby-forum.com/t/can-the-read-method-execute-any-files/185916/4 "2010-03-30T02:16:50Z")

</div>

Thank you Frederick.  
That’s what I was thinking (hoping).

@pepe  
I do check it’s MIME type before uploading, but the file is actually  
never saved. So as long as .read, or parsing, won’t trigger the exe/  
ruby/php script, then I think I’m ok.

On Mar 29, 3:56 am, Frederick C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)