From 798316eac260e3cd683da2be23fef53ee64cee00 Mon Sep 17 00:00:00 2001 From: shugo Date: Tue, 20 Mar 2018 09:09:49 +0000 Subject: io.c: Methods of File should not invoke external commands For security reasons, File.read, File.binread, File.write, File.binwrite, File.foreach, and File.readlines should not invoke external commands even if the path starts with the pipe character |. [ruby-core:84495] [Feature #14245] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62857 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- test/ruby/test_io.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'test/ruby') diff --git a/test/ruby/test_io.rb b/test/ruby/test_io.rb index 7d7e198334..a271c9e677 100644 --- a/test/ruby/test_io.rb +++ b/test/ruby/test_io.rb @@ -2196,10 +2196,10 @@ class TestIO < Test::Unit::TestCase def test_read_command assert_equal("foo\n", IO.read("|echo foo")) - assert_warn(/invoke external command/) do + assert_raise(Errno::ENOENT, Errno::EINVAL) do File.read("|#{EnvUtil.rubybin} -e puts") end - assert_warn(/invoke external command/) do + assert_raise(Errno::ENOENT, Errno::EINVAL) do File.binread("|#{EnvUtil.rubybin} -e puts") end assert_raise(Errno::ENOENT, Errno::EINVAL) do -- cgit v1.2.3