Skip to content

Commit

Permalink
storage_local: Use File.open instead of Kernel.open
Browse files Browse the repository at this point in the history
* https://www.rubydoc.info/gems/rubocop/RuboCop/Cop/Security/Open

```
`Kernel#open` and `URI.open` enable not only file access but also process invocation
by prefixing a pipe symbol (e.g., `open(“| ls”)`).
So, it may lead to a serious security risk by using variable input
to the argument of `Kernel#open` and `URI.open`.
It would be better to use `File.open`, `IO.popen` or `URI.parse#open` explicitly.
```

Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
  • Loading branch information
cosmo0920 committed Mar 12, 2021
1 parent da44013 commit 66d4af4
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions lib/fluent/plugin/storage_local.rb
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,7 @@ def configure(conf)
if File.exist?(@path)
raise Fluent::ConfigError, "Plugin storage path '#{@path}' is not readable/writable" unless File.readable?(@path) && File.writable?(@path)
begin
data = open(@path, 'r:utf-8') { |io| io.read }
data = File.open(@path, 'r:utf-8') { |io| io.read }
if data.empty?
log.warn "detect empty plugin storage file during startup. Ignored: #{@path}"
return
Expand Down Expand Up @@ -115,7 +115,7 @@ def load
return if @on_memory
return unless File.exist?(@path)
begin
json_string = open(@path, 'r:utf-8'){ |io| io.read }
json_string = File.open(@path, 'r:utf-8'){ |io| io.read }
json = Yajl::Parser.parse(json_string)
unless json.is_a?(Hash)
log.error "broken content for plugin storage (Hash required: ignored)", type: json.class
Expand All @@ -133,7 +133,7 @@ def save
tmp_path = @path + '.tmp'
begin
json_string = Yajl::Encoder.encode(@store, pretty: @pretty_print)
open(tmp_path, 'w:utf-8', @mode) { |io| io.write json_string; io.fsync }
File.open(tmp_path, 'w:utf-8', @mode) { |io| io.write json_string; io.fsync }
File.rename(tmp_path, @path)
rescue => e
log.error "failed to save data for plugin storage to file", path: @path, tmp: tmp_path, error: e
Expand Down

0 comments on commit 66d4af4

Please sign in to comment.