From: CPANSec Security Scanner Bot <cpan-security@security.metacpan.org>
Subject: [PATCH] PDF::WebKit: use 3-arg open for output/stylesheet reads

to_pdf reads the generated PDF back, and _style_tag_for reads each
stylesheet, using the diamond operator over a locally-set @ARGV. `<>`
performs Perl's 2-argument magic open on each element, so the value is
not always taken as a file name: "cmd |" runs cmd and returns its
output in place of the file, "| cmd" runs cmd, and "> path" or
">> path" opens that path for writing, truncating it in the first form
(CWE-78, CWE-73). Switch both sites to 3-argument open, which always
treats its argument as a file name.

The failure behaviour of each site is kept as it was. In to_pdf an
unreadable path leaves $output undefined, so the existing "command
failed" check still reports the renderer failure that usually causes
it, and the read-back is done in binary mode to match the ':raw'
layers that run3 was given. In _style_tag_for an unreadable stylesheet
warns and contributes an empty <style> element rather than aborting
the render.

diff --git a/lib/PDF/WebKit.pm b/lib/PDF/WebKit.pm
index 5e83e5b..36b35e2 100755
--- a/lib/PDF/WebKit.pm
+++ b/lib/PDF/WebKit.pm
@@ -101,7 +101,19 @@ sub to_pdf {
   run3 \@args, \$input, \$output, \my $err, \%opt;
 
   if ($path) {
-    $output = do { local (@ARGV,$/) = ($path); <> };
+    # SECURITY: 3-arg open, so that a "cmd |", "| cmd" or "> path"
+    # value is always taken as a file name. As before, a path that
+    # cannot be read leaves $output undefined, and the check below
+    # reports the renderer failure that is the usual cause.
+    undef $output;
+    if (open my $pdf_fh, '<', $path) {
+      binmode $pdf_fh;
+      $output = do { local $/; <$pdf_fh> };
+      close $pdf_fh;
+    }
+    else {
+      Carp::carp "can't open '$path': $!";
+    }
   }
 
   if (not (defined($output) && length($output))) {
@@ -161,7 +173,19 @@ sub _pdf_webkit_meta_tags {
 
 sub _style_tag_for {
   my ($self,$stylesheet) = @_;
-  my $styles = do { local (@ARGV,$/) = ($stylesheet); <> };
+  # SECURITY: 3-arg open, so that a "cmd |", "| cmd" or "> path"
+  # stylesheet value is always taken as a file name. As before, a
+  # stylesheet that cannot be read warns and contributes an empty
+  # <style> element rather than being fatal.
+  my $styles = '';
+  if (open my $css_fh, '<', $stylesheet) {
+    $styles = do { local $/; <$css_fh> };
+    $styles = '' unless defined $styles;
+    close $css_fh;
+  }
+  else {
+    Carp::carp "can't open stylesheet '$stylesheet': $!";
+  }
   return "<style>$styles</style>";
 }