fix(security): prevent command injection in Mechanize#download

Related to GHSA-qrqm-fpv6-6r8g
sparklemotion · Jan 30, 2021 · 2ac906b · 2ac906b
1 parent aae0b13
commit 2ac906b
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/lib/mechanize.rb b/lib/mechanize.rb
@@ -396,7 +396,7 @@ def download uri, io_or_filename, parameters = [], referer = nil, headers = {}
     io = if io_or_filename.respond_to? :write then
            io_or_filename
          else
-           open io_or_filename, 'wb'
+           ::File.open(io_or_filename, 'wb')
          end
 
     case page

diff --git a/test/test_mechanize.rb b/test/test_mechanize.rb
@@ -345,6 +345,14 @@ def test_download_filename_error
     end
   end
 
+  def test_download_does_not_allow_command_injection
+    in_tmpdir do
+      @mech.download('http://example', '| ruby -rfileutils -e \'FileUtils.touch("vul.txt")\'')
+
+      refute_operator(File, :exist?, "vul.txt")
+    end
+  end
+
   def test_get
     uri = URI 'http://localhost'