Sign upLogin

ManageIQ/manageiq-smartstate

View on GitHub
Star
lib/db/MiqBdb/MiqBdb.rb

Summary

Maintainability
A
2 hrs
Test Coverage
D
60%

Class MiqBdb has 22 methods (exceeds 20 allowed). Consider refactoring.
Open

  class MiqBdb
    attr_reader :db, :header

    def initialize(fileName = nil, fs = nil)
      @fs = fs unless fs.nil?
Severity: Minor
Found in lib/db/MiqBdb/MiqBdb.rb - About 2 hrs to fix

The use of Kernel#open is a serious security risk.
Open

      open(fileName) unless fileName.nil?
Severity: Minor
Found in lib/db/MiqBdb/MiqBdb.rb by rubocop

Checks for the use of Kernel#open and URI.open with dynamic data.

Kernel#open and URI.open enable not only file access but also process invocation by prefixing a pipe symbol (e.g., open("| ls")). So, it may lead to a serious security risk by using variable input to the argument of Kernel#open and URI.open. It would be better to use File.open, IO.popen or URI.parse#open explicitly.

NOTE: open and URI.open with literal strings are not flagged by this cop.

Safety:

This cop could register false positives if open is redefined in a class and then used without a receiver in that class.

Example:

# bad
open(something)
open("| #{something}")
URI.open(something)

# good
File.open(something)
IO.popen(something)
URI.parse(something).open

# good (literal strings)
open("foo.text")
open("| foo")
URI.open("http://example.com")

There are no issues that match your filters.

Category
Status