From 73f72e428d2b55cc358086d460141a2c3d7d561b Mon Sep 17 00:00:00 2001 From: Geremia Taglialatela Date: Sat, 8 Apr 2023 12:08:29 +0200 Subject: Use File.read instead of IO.read If argument starts with a pipe character (`'|'`) and the receiver is the `IO` class, a subprocess is created in the same way as `Kernel#open`, and its output is returned. `Kernel#open` may allow unintentional command injection, which is the reason these `IO` methods are a security risk. Consider to use `File.read` to disable the behavior of subprocess invocation. Close #193 Ref: https://www.rubydoc.info/gems/rubocop/RuboCop/Cop/Security/IoMethods --- lib/axlsx/package.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/axlsx/package.rb b/lib/axlsx/package.rb index 6baaa173..be34788b 100644 --- a/lib/axlsx/package.rb +++ b/lib/axlsx/package.rb @@ -187,7 +187,7 @@ module Axlsx end unless part[:path].nil? zip.put_next_entry(zip_entry_for_part(part)) - zip.write IO.read(part[:path], mode: "rb") + zip.write File.read(part[:path], mode: "rb") end end zip -- cgit v1.2.3