Commits on Apr 7, 2024

1. Use File.read instead of IO.read …

   If argument starts with a pipe character (`'|'`) and the receiver is
   the `IO` class, a subprocess is created in the same way as
   `Kernel#open`, and its output is returned. `Kernel#open` may allow
   unintentional command injection, which is the reason these `IO` methods
   are a security risk. Consider to use `File.read` to disable the
   behavior of subprocess invocation.
   
   Ref: https://www.rubydoc.info/gems/rubocop/RuboCop/Cop/Security/IoMethods

   

   tagliala committed Apr 7, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for d96c4df
   • Browse repository at this point

   Copy the full SHA

   d96c4df View commit details

   Browse the repository at this point in the history