search

premailer / css_parser

Ruby CSS Parser
Other
279 stars 110 forks source link

Don't require open-uri #45

Closed aripollak closed 11 years ago

aripollak commented 11 years ago

It isn't needed here anyway, and is extremely dangerous from a security perspective - simply doing a require 'css_parser' causes every open() in the calling program to suddenly start accepting any HTTP/FTP URIs, which could be very surprising and unexpected.

morten commented 11 years ago

open is used here https://github.com/alexdunae/css_parser/blob/master/lib/css_parser/parser.rb#L428 - if you can move the require around and still make things work then that would be a better solution

aripollak commented 11 years ago

open is used there, but it's only used to open a local file - so the built-in Ruby open should work fine.

nextmat commented 11 years ago

+1 this seems like a nasty violation of principle of least surprise.