Future-proofing in case future versions of Perl warn on this, since
2-arg forms of open may be subject to injection vulnerabilities
with non-literal args.
---
 lib/PublicInbox/LEI.pm | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/PublicInbox/LEI.pm b/lib/PublicInbox/LEI.pm
index 192f267ca1dd..4e0295fa4e8a 100644
--- a/lib/PublicInbox/LEI.pm
+++ b/lib/PublicInbox/LEI.pm
@@ -818,7 +818,8 @@ sub dispatch {
                                next if $d eq ''; # same as git(1)
                                chdir $d or return fail($self, "cd $d: $!");
                        }
-                       open $self->{3}, '.' or return fail($self, "open . $!");
+                       open $self->{3}, '<', '.' or
+                               return fail($self, "open . $!");
                }
                $cb->($self, @argv);
        } elsif (grep(/\A-/, $cmd, @argv)) { # --help or -h only
--
unsubscribe: one-click, see List-Unsubscribe header
archive: https://public-inbox.org/meta/

Reply via email to