From fe3c49c9baeeab58304ede915b7edd18ecf360fc Mon Sep 17 00:00:00 2001 From: usa Date: Sat, 3 Jul 2021 17:10:28 +0000 Subject: merge revision(s) b1c73f23,c9ab8fe2: [Backport #17877] [ruby/rdoc] Use File.open to fix the OS Command Injection vulnerability in CVE-2021-31799 https://github.com/ruby/rdoc/commit/a7f5d6ab88 The test for command injection on Unix platforms should be omitted on Windows git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67947 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- lib/rdoc/rdoc.rb | 2 +- lib/rdoc/version.rb | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'lib') diff --git a/lib/rdoc/rdoc.rb b/lib/rdoc/rdoc.rb index ca2c1abefd..46aace7839 100644 --- a/lib/rdoc/rdoc.rb +++ b/lib/rdoc/rdoc.rb @@ -430,7 +430,7 @@ The internal error was: files.reject do |file| file =~ /\.(?:class|eps|erb|scpt\.txt|svg|ttf|yml)$/i or (file =~ /tags$/i and - open(file, 'rb') { |io| + File.open(file, 'rb') { |io| io.read(100) =~ /\A(\f\n[^,]+,\d+$|!_TAG_)/ }) end diff --git a/lib/rdoc/version.rb b/lib/rdoc/version.rb index 3291414597..dc1ea6cbb1 100644 --- a/lib/rdoc/version.rb +++ b/lib/rdoc/version.rb @@ -3,6 +3,6 @@ module RDoc ## # RDoc version you are using - VERSION = '6.1.2' + VERSION = '6.1.2.1' end -- cgit v1.2.3