Enable Security cops

Also fixes a Security/Open offense that couldn't be exploited, because
the only invocation of `get_mime_type_from_uri` was validating the
input with a `URI::DEFAULT_PARSER` regexp

4 files changed, 8 insertions, 6 deletions

diff --git a/.rubocop.yml b/.rubocop.yml
index 4ab6b157..44874c85 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -34,6 +34,9 @@ Minitest:
 Performance:
   Enabled: true
 
+Security:
+  Enabled: true
+
 Style:
   Enabled: true
 
diff --git a/.rubocop_todo.yml b/.rubocop_todo.yml
index 1de00edb..87314a2a 100644
--- a/.rubocop_todo.yml
+++ b/.rubocop_todo.yml
@@ -77,11 +77,6 @@ Lint/UnusedMethodArgument:
     - 'lib/axlsx/package.rb'
     - 'lib/axlsx/util/validators.rb'
 
-Lint/UselessAssignment:
-  Exclude:
-    - 'lib/axlsx/workbook/worksheet/header_footer.rb'
-    - 'lib/axlsx/workbook/worksheet/sheet_protection.rb'
-
 # Configuration parameters: MinSize.
 Performance/CollectionLiteralInLoop:
   Exclude:
diff --git a/lib/axlsx/util/mime_type_utils.rb b/lib/axlsx/util/mime_type_utils.rb
index c2e6909f..fbe39448 100644
--- a/lib/axlsx/util/mime_type_utils.rb
+++ b/lib/axlsx/util/mime_type_utils.rb
@@ -16,7 +16,7 @@ module Axlsx
     # @param [String] v URI
     # @return [String] File mime type
     def self.get_mime_type_from_uri(v)
-      Marcel::MimeType.for(URI.open(v))
+      Marcel::MimeType.for(URI.parse(v).open)
     end
   end
 end
diff --git a/test/util/tc_mime_type_utils.rb b/test/util/tc_mime_type_utils.rb
index 568aa61d..fc7d9d79 100644
--- a/test/util/tc_mime_type_utils.rb
+++ b/test/util/tc_mime_type_utils.rb
@@ -17,4 +17,8 @@ class TestMimeTypeUtils < Test::Unit::TestCase
     assert_equal('image/jpeg', Axlsx::MimeTypeUtils::get_mime_type(@test_img))
     assert_equal('image/png', Axlsx::MimeTypeUtils::get_mime_type_from_uri(@test_img_url))
   end
+
+  def test_escape_uri
+    assert_raise(URI::InvalidURIError) { Axlsx::MimeTypeUtils::get_mime_type_from_uri('| ls') }
+  end
 end