diff options
| author | Jeff King <peff@peff.net> | 2022-10-05 16:25:13 +0300 |
|---|---|---|
| committer | Jeff King <peff@peff.net> | 2022-10-05 16:28:15 +0300 |
| commit | f95bb4e29c1c9ca591831f5edddc8c85e5d47579 (patch) | |
| tree | ecc8ff96fbe4dbd66f79481d2a26e8c39f239817 | |
| parent | 360faca8d7d67a3fa60bb7e02f21df5d98730ff0 (diff) | |
download_service: avoid unsafe URL.open()
Instead we can pass through URL.parse.open, which isn't susceptible to
being fed "|echo oops, you were owned". In our case it's already OK; we
are feeding only a URL defined earlier in the file. However, the
files_from_sourceforge() method itself is unsafe, and a new caller could
trigger a vulnerability. So let's fix it now, which also appeases
rubocop.
| -rw-r--r-- | app/services/download_service.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/app/services/download_service.rb b/app/services/download_service.rb index 83952671..81c48d0a 100644 --- a/app/services/download_service.rb +++ b/app/services/download_service.rb @@ -96,7 +96,7 @@ class DownloadService def files_from_sourceforge(repository) downloads = [] - rss = URI.open(repository).read + rss = URI.parse(repository).open.read feed = RSS::Parser.parse(rss) feed.items.each do |item| |