Fix Use of Kernel.open or IO.read or similar sinks with a non-constant value

[odaysec]

fix the problem, replace the call to open(path, 'wb') with File.open(path, 'wb'). This ensures that the file is opened for writing without invoking the potentially dangerous behavior of Kernel.open. No other changes are needed, as the rest of the code is compatible with File.open. The change should be made in the update_specs method, specifically on line 48 of lib/rubygems/mirror.rb. No new imports or method definitions are required.

References

Command Injection. Ruby on Rails Cheat Sheet: Command Injection
Command Injection in RDoc

[hsbt]

👍