Overview

This should help resolve #443 that resulted from CodeQL reporting:

Use of Kernel.open or IO.read or similar sinks with a non-constant value

Approach

I've switched from:

URI.open(content, default_headers.merge(headers), &block)

To:

URI.parse(content).open(default_headers.merge(headers), &block)

This should resolve the following case:

If Kernel.open is given a file name that starts with a | character, it will execute the remaining string as a shell command. If a malicious user can control the file name, they can execute arbitrary code. The same vulnerability applies to IO.read, IO.write, IO.binread, IO.binwrite, IO.foreach, IO.readlines and URI.open.