From 4dabf1a9c679f06b3637d3c76e1e05aa83a6d259 Mon Sep 17 00:00:00 2001 From: Gervase Markham Date: Wed, 21 Jan 2015 19:49:57 +0000 Subject: Bug 1079065: [SECURITY] Always use the 3 arguments form for open() to prevent shell code injection r=dylan,a=simon --- Bugzilla/Attachment.pm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'Bugzilla/Attachment.pm') diff --git a/Bugzilla/Attachment.pm b/Bugzilla/Attachment.pm index e165b139e..ed770ad89 100644 --- a/Bugzilla/Attachment.pm +++ b/Bugzilla/Attachment.pm @@ -333,7 +333,7 @@ sub data { # If there's no attachment data in the database, the attachment is stored # in a local file, so retrieve it from there. if (length($self->{data}) == 0) { - if (open(AH, $self->_get_local_filename())) { + if (open(AH, '<', $self->_get_local_filename())) { # file is actually on disk. $self->{is_on_filesystem} = 1; local $/; @@ -412,7 +412,7 @@ sub datasize { # is stored in a local file, and so retrieve its size from the file, # or the attachment has been deleted. unless ($self->{datasize}) { - if (open(AH, $self->_get_local_filename())) { + if (open(AH, '<', $self->_get_local_filename())) { # file is actually on disk. $self->{is_on_filesystem} = 1; binmode AH; -- cgit v1.2.3-24-g4f1b