Use File.read instead of Kernel.open

To avoid command injection with | strings

lib/bibtex/bibliography.rb

@@ -47,7 +47,7 @@ class << self
       # -:filter: convert all entries using the sepcified filter (not set by default)
       #
       def open(path, options = {})
-        b = parse(Kernel.open(path, 'r:UTF-8').read, options)
+        b = parse(File.read(path), options)
         b.path = path
         return b unless block_given?