<p>R in general was not built with security in mind (see also this <a href="http://arxiv.org/abs/1303.4808" rel="nofollow noreferrer">preprint</a> at arXiv by Jeroen Ooms). It is also notorious for <a href="https://stackoverflow.com/questions/11700748/why-does-the-number-1e9999-31-9s-cause-problems-in-r">flaky parsing of numbers</a>.</p>

<p>Judging from the source code (which was <a href="https://github.com/clbustos/rinruby/blob/master/lib/rinruby.rb" rel="nofollow noreferrer">not updated for 2 years</a> (!)) RinRuby doesn't seem to provide any kind of isolation from injection either - bare-bones <code>eval</code> is a gateway to hell, they say :)</p>

<p>Thus, it falls upon your shoulders to follow e.g. <a href="https://www.owasp.org/index.php/Main_Page" rel="nofollow noreferrer">OWASP guidelines</a> to avoid injection by carefully validating, parameterizing and whitelisting the input. Having in mind the above-mentioned quirks in parsing numbers, you have to restrict inputs to sane intervals.</p>

<p>Just my 2 cents...</p>
Is using RinRuby secure for web solutions?
<p>I recall from some meetups I've attended in NYC that people in bell labs were trying to work on potential security issues with R on the web.  There was potential risks of code injection into a Web App if R sessions were kept alive for the user.</p>

<p>Now, this was presented in the context of HTML 5 and PHP, but I don't see how it would be different when using RoR with the RinRuby gem.  Is there a set of rules we as developers should follow to avoid common security pitfalls when using this gem?</p>