fix(security): prevent command injection in Mechanize#download

Related to GHSA-qrqm-fpv6-6r8g
sparklemotion · Jan 30, 2021 · 2ac906b · 2ac906b
1 parent aae0b13
commit 2ac906b
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/lib/mechanize.rb b/lib/mechanize.rb
@@ -396,7 +396,7 @@ def download uri, io_or_filename, parameters = [], referer = nil, headers = {}
  io = if io_or_filename.respond_to? :write then
  io_or_filename
  else
- open io_or_filename, 'wb'
+ ::File.open(io_or_filename, 'wb')
  end
 
  case page

diff --git a/test/test_mechanize.rb b/test/test_mechanize.rb
@@ -345,6 +345,14 @@ def test_download_filename_error
  end
  end
 
+ def test_download_does_not_allow_command_injection
+ in_tmpdir do
+ @mech.download('http://example', '| ruby -rfileutils -e \'FileUtils.touch("vul.txt")\'')
+
+ refute_operator(File, :exist?, "vul.txt")
+ end
+ end
+
  def test_get
  uri = URI 'http://localhost'