fix(security): replace IO.read with File.read (#378)

Author: pkuczynski

CHANGELOG.md

@@ -1,8 +1,12 @@
 # Changelog
 
+## Next
+
+* fix(security): replace IO.read with File.read [#378](https://github.com/rubyconfig/config/pull/378)
+
 ## 5.6.0
 
-* Added `extra_sources` in initializer  ([#366](https://github.com/rubyconfig/config/pull/366))
+* Added `extra_sources` in initializer ([#366](https://github.com/rubyconfig/config/pull/366))
 
 ## 5.5.2
 

lib/config/sources/yaml_source.rb

@@ -15,7 +15,7 @@ def initialize(path, evaluate_erb: Config.evaluate_erb_in_yaml)
       # returns a config hash from the YML file
       def load
         if @path and File.exist?(@path)
-          file_contents = IO.read(@path)
+          file_contents = File.read(@path)
           file_contents = ERB.new(file_contents).result if evaluate_erb
           result = YAML.respond_to?(:unsafe_load) ? YAML.unsafe_load(file_contents) : YAML.load(file_contents)
         end

spec/support/rails_helper.rb

@@ -5,7 +5,7 @@
 # Loads ENV vars from a yaml file
 def load_env(filename)
   if filename and File.exist?(filename.to_s)
-    result = YAML.load(ERB.new(IO.read(filename.to_s)).result)
+    result = YAML.load(ERB.new(File.read(filename.to_s)).result)
   end
   result.each { |key, value| ENV[key.to_s] = value.to_s } unless result.nil?
 end