Security: Pod::POM::parse_file() uses 2-argument open()

[guimard]

Hello,

a Debian user reported a security issue:

The Pod::POM::parse_file function uses 2-argument open().
As a consequence, podlint can't be used securely to check files with untrusted names.

Proof of concept:

  $ touch '; cowsay pwned >&2 |'
  $ podlint ./*
  sh: 1: ./: Permission denied

Below a trivial patch:

--- a/lib/Pod/POM.pm
+++ b/lib/Pod/POM.pm
@@ -138,7 +138,7 @@
        local *FP;
        local $/ = undef;
        $name = ( $file eq '-' ? '<standard input>' : $file );
-       open(FP, $file) || return $self->error("$file: $!");
+       open(FP, '<', $file) || return $self->error("$file: $!");
        $text = <FP>;
        close(FP);
     }