Question: For example, if a client submits a file to a server, and the server opens the file in read-mode with Python:

```
with open(uploaded_file, "r") as f:
    # Do something

```

Could the act of opening a file be abused with a cleverly-crafted file from the client? Does it depend on the language used by the server?

Answer: 
No.

If the filename is controlled by the user, then you might open yourself up to vulnerabilities (e.g. an attacker might try to read config files with the database password). But just opening a file handle for an uploaded file can't do much.

Perhaps if the underlying mechanism would try to read the whole file for buffering purposes, it might fill up RAM and crash the process, but Python doesn't do that: to read the whole file, you would first have to call `f.read()` -- but that is just what you do with it, and not opening the file. Only opening the file is harmless.
**Not the act of opening, but the act of reading (in text mode).**

The `open()` function falls back on several defaults when you don't specify the parameters. This is what the code snippet you provided does:

* Opens the file in text mode (no "b" in mode flags).
* Calls `locale.getpreferredencoding(False)` to determine which decoder to use (no `encoding` specified).
* Configures the decoder to throw exceptions when it encounters an error (no `errors` specified).

Now, say you want to actually `# Do something` like read from the file, e.g. with `f.readline()`. This is what happens:

1. Binary data is read from the file.
2. **The decoder interprets the bytes in order to turn them into a Python string.**
	* If it encounters an invalid byte sequence, it raises a ValueError.
3. Newline sequences are substituted.

Even if you remember to handle the ValueError, there is still some risk. Decoders can have rather complicated logic, so it is very possible for them to have vulnerabilities that are triggered by a cleverly crafted sequence of bytes. For example, at one point a [problem in the decoder used by the language Go](https://nvd.nist.gov/vuln/detail/CVE-2020-14040) made it possible to send it into an infinite loop.

This only happens because the file is opened in text mode. If you open it in binary mode ("rb") instead, you can safely read the raw bytes from it.