Commits on Dec 28, 2017

1. Add new Security/Open cop …

   `Kernel#open` is considered harmful for production use.  Some programs use `Kernel#open` with untrusted input, but it allows command injection by prefixing a pipe (`|`).  [An actual vulnerability](https://www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/) is found, and deprecating `open("|...")` is [proposed in bugs.ruby-lang.org](https://bugs.ruby-lang.org/issues/14239).  I'm unsure if the deprecation is really good, but at least it would be a good idea for Rubocop to prevent such a bad usage of `Kernel#open`.
   
   ```console
   % cat /tmp/test.rb
   
   open(something)
   ```
   
   ```console
   % bundle exec bin/rubocop /tmp/test.rb
   Inspecting 1 file
   C
   
   Offenses:
   
   /tmp/test.rb:3:1: C: Security/Open: The use of open is a serious security risk.
   open(something)
   ^^^^
   
   1 file inspected, 1 offense detected
   ```

   

   mame committed Dec 28, 2017
   Configuration menu

   • View commit details
   • Copy full SHA for f398a97
   • Browse repository at this point

   Copy the full SHA

   f398a97 View commit details

   Browse the repository at this point in the history