Kernel#open
detected RB-SC1004Kernel#open
enables not only file access but also process invocation by prefixing a pipe symbol (e.g., open("| ls")
). So, it may lead to a serious
security risk by using variable input to the argument of Kernel#open
. It would be better to use File.open
, IO.popen
or URI#open
explicitly.
open(something)
File.open(something)
IO.popen(something)
URI.parse(something).open