cobalt-rubocop 0.1.0 → 0.5.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (9) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +17 -1
  3. data/README.md +63 -15
  4. data/config/default.yml +4 -0
  5. data/config/rspec.yml +1 -0
  6. data/lib/rubocop/cobalt/version.rb +7 -0
  7. data/lib/rubocop/cop/cobalt/insecure_hash_algorithm.rb +123 -0
  8. data/lib/rubocop/cop/cobalt.rb +3 -0
  9. metadata +30 -13
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: c08db73a41f4beaee02f72349ba019f38884ed65030ca622cffb6e2bb76d0dfe
4
- data.tar.gz: '06588084616ac4a8e65741a3c251de8988faf4e2157bef50a8f290f64c7a5dd4'
3
+ metadata.gz: e6dc98fd50cb09459ed2b1549f9946ee1d0e73ad7be7c099b22c1ca78641cabc
4
+ data.tar.gz: bb451d97a1ef101b4a80c4d9bb66e46fed55b1b5f55a07d42f9c063c78f46139
5
5
  SHA512:
6
- metadata.gz: ccf9019e8758ea7b9c170c89a6f4cda9417251a114776b0682e9dd08da99df921641efd67d1bb4e64746af9d895576ddebe3cd6d56430ddc3011ed9c92958335
7
- data.tar.gz: 35fdb07709b25dbb699f730a8aa3c13d30a244aad2d7745f1db4542d03e063dd8cc5dc7922fed21311faf941ab9e8982e479110af7b97fe1e57d8a22d92e862d
6
+ metadata.gz: 864612e1bc4558bae753049b59b41387b74a7a8c83bd605b319da05f30f8c1661b984a3bd5e3305840a8eb67e3605f336960f9f4815d8d6cb5e02de48a6c68ba
7
+ data.tar.gz: d3c100cf002c07b94aa64f4603b342f1351abdb6cd4e46a4b37e640a82bea26a7b9cd8854ef956179d0e811a54589ab39dd011b0d062cef54fecfbd959f47a6a
data/CHANGELOG.md CHANGED
@@ -1,5 +1,21 @@
1
- # 0.1.0
1
+ # CHANGELOG
2
+ ## main (unreleased)
3
+ * WIP
2
4
 
5
+ ## 0.5.0 (2022-01-25)
6
+ * Update Gem versions ([#8](https://github.com/cobalthq/cobalt-rubocop/pull/8))
7
+
8
+ ## 0.4.0 (2021-09-07)
9
+ * Update Gem versions ([#7](https://github.com/cobalthq/cobalt-rubocop/pull/7))
10
+
11
+ ## 0.3.0 (2021-04-16)
12
+ * Update Rubocop and Rubocop Performance versions ([#6](https://github.com/cobalthq/cobalt-rubocop/pull/6))
13
+
14
+ ## 0.2.0 (2021-04-14)
15
+ * Avoid warnings on RSpec `let` with parameter arrays ([#5](https://github.com/cobalthq/cobalt-rubocop/pull/5))
16
+ * Add new cop `InsecureHashAlgorithm`. ([#3](https://github.com/cobalthq/cobalt-rubocop/pull/3))
17
+
18
+ ## 0.1.0 (2021-02-10)
3
19
  * Introduce default rules
4
20
  * Introduce rails rules
5
21
  * Introduce rspec rules
data/README.md CHANGED
@@ -1,19 +1,37 @@
1
1
  # Cobalt RuboCop
2
+ [![Gem Version](https://badge.fury.io/rb/cobalt-rubocop.svg)](https://badge.fury.io/rb/cobalt-rubocop)
3
+ [![GitHub License](https://img.shields.io/github/license/cobalthq/cobalt-rubocop.svg)](https://github.com/cobalthq/cobalt-rubocop/blob/main/LICENSE)
4
+ ![Gem Downloads](https://img.shields.io/gem/dt/cobalt-rubocop)
5
+ [![Ruby Style Guide](https://img.shields.io/badge/code_style-rubocop-brightgreen.svg)](https://github.com/rubocop-hq/rubocop)
2
6
 
3
7
  This repository provides recommended linting rules for Ruby repositories.
4
8
 
5
9
  ## Installation
6
10
 
7
11
  ### Gemfile
12
+ #### Add
13
+ ```ruby
14
+ group :development do
15
+ gem 'cobalt-rubocop', require: false
16
+ end
17
+ ```
8
18
 
9
- ```ruby
10
- group :development do
11
- gem 'cobalt-rubocop', require: false, git: 'https://github.com/cobalthq/cobalt-rubocop', branch: :main
12
- end
13
- ```
19
+ #### Remove
20
+ ```ruby
21
+ gem 'rubocop', require: false
22
+ gem 'rubocop-performance', require: false
23
+ gem 'rubocop-rails', require: false
24
+ gem 'rubocop-rspec', require: false
25
+ ```
14
26
 
15
- ### .rubocop.yml
27
+ [Specific versions](https://github.com/cobalthq/cobalt-rubocop/blob/main/cobalt-rubocop.gemspec) installed for:
28
+ - [rubocop](https://github.com/rubocop-hq/rubocop)
29
+ - [rubocop-performance](https://github.com/rubocop/rubocop-performance)
30
+ - [rubocop-rails](https://github.com/rubocop/rubocop-rails)
31
+ - [rubocop-rspec](https://github.com/rubocop/rubocop-rspec)
16
32
 
33
+ ### .rubocop.yml
34
+ Configuration Options:
17
35
  ```yaml
18
36
  inherit_gem:
19
37
  cobalt-rubocop:
@@ -41,11 +59,37 @@ The number of offences can be counted:
41
59
  grep "Offense count" .rubocop_todo.yml | awk -F: '{sum+=$2} END {print sum}'
42
60
  ```
43
61
 
62
+ ## Custom Cops
63
+ ### InsecureHashAlgorithm
64
+ See [Ruby Docs](https://ruby-doc.org/stdlib-2.7.2/libdoc/openssl/rdoc/OpenSSL/Digest.html) for built in hash functions.
65
+
66
+ - Default Configuration:
67
+ ```yml
68
+ Cobalt/InsecureHashAlgorithm:
69
+ Allowed:
70
+ - SHA256
71
+ - SHA384
72
+ - SHA512
73
+ ```
74
+
75
+ ```ruby
76
+ # bad
77
+ OpenSSL::Digest::MD5.digest('abc')
78
+ OpenSSL::Digest::SHA1.digest('abc')
79
+ OpenSSL::HMAC.new('abc', 'sha1')
80
+
81
+ # good
82
+ OpenSSL::Digest::SHA256.digest('abc')
83
+ OpenSSL::Digest::SHA384.digest('abc')
84
+ OpenSSL::Digest::SHA512.digest('abc')
85
+ OpenSSL::HMAC.new('abc', 'sha256')
86
+ ```
87
+
44
88
  ## Development
45
89
  ```shell
46
90
  git clone git@github.com:cobalthq/cobalt-rubocop.git
47
- gem install bundler:2.2.2
48
- bundle _2.2.2_
91
+ gem install bundler:2.2.16
92
+ bundle _2.2.16_
49
93
  ```
50
94
 
51
95
  ### Testing locally
@@ -55,10 +99,14 @@ In your application, use the `path` attribute to point to your local copy of the
55
99
  gem 'cobalt-rubocop', path: '../cobalt-rubocop', require: false
56
100
  ```
57
101
 
58
- ### Publishing the gem
59
- If you have access to publish the gem on rubygems:
60
- ```shell
61
- rake build
62
- cd pkg
63
- gem push cobalt-rubocop-<version_number>.gem
64
- ```
102
+ Alternatively:
103
+ - `rake build`
104
+ - `gem install pkg/cobalt-rubocop-<version_number>.gem`
105
+
106
+ ## Publish (internal)
107
+ > Note: Publishing a new version of this gem is only meant for maintainers.
108
+ - Ensure you have access to publish on [rubygems](https://rubygems.org/gems/cobalt-rubocop).
109
+ - Update [CHANGELOG](https://github.com/cobalthq/cobalt-rubocop/blob/main/CHANGELOG.md).
110
+ - Update [`VERSION`](https://github.com/cobalthq/cobalt-rubocop/blob/main/lib/rubocop/cobalt/version.rb).
111
+ - `rake release`
112
+ - This command builds the gem, creates a tag and publishes to rubygems, see [bundler docs](https://bundler.io/guides/creating_gem.html#releasing-the-gem).
data/config/default.yml CHANGED
@@ -1,5 +1,6 @@
1
1
  require:
2
2
  - rubocop-performance
3
+ - rubocop/cop/cobalt
3
4
 
4
5
  AllCops:
5
6
  NewCops: enable
@@ -57,3 +58,6 @@ Style/IfUnlessModifier:
57
58
 
58
59
  Style/ClassAndModuleChildren:
59
60
  EnforcedStyle: nested
61
+
62
+ Cobalt/InsecureHashAlgorithm:
63
+ Enabled: true
data/config/rspec.yml CHANGED
@@ -14,6 +14,7 @@ RSpec/MessageSpies:
14
14
  RSpec/VariableName:
15
15
  IgnoredPatterns:
16
16
  - ^Authorization
17
+ - '\[\]$' # For array parameters in rswag like `let(:'<parameter_name>[]')`
17
18
 
18
19
  RSpec/MultipleMemoizedHelpers:
19
20
  Max: 17
data/lib/rubocop/cobalt/version.rb ADDED
@@ -0,0 +1,7 @@
1
+ # frozen_string_literal: true
2
+
3
+ module RuboCop
4
+ module Cobalt
5
+ VERSION = '0.5.0'
6
+ end
7
+ end
data/lib/rubocop/cop/cobalt/insecure_hash_algorithm.rb ADDED
@@ -0,0 +1,123 @@
1
+ # frozen_string_literal: true
2
+
3
+ # original code from https://github.com/github/rubocop-github/blob/master/lib/rubocop/cop/github/insecure_hash_algorithm.rb
4
+
5
+ module RuboCop
6
+ module Cop
7
+ module Cobalt
8
+ class InsecureHashAlgorithm < Cop
9
+ # Matches constants like these:
10
+ # Digest::MD5
11
+ # OpenSSL::Digest::MD5
12
+ def_node_matcher :insecure_const?, <<-PATTERN
13
+ (const (const _ :Digest) #insecure_algorithm?)
14
+ PATTERN
15
+
16
+ # Matches calls like these:
17
+ # Digest.new('md5')
18
+ # Digest.hexdigest('md5', 'str')
19
+ # OpenSSL::Digest.new('md5')
20
+ # OpenSSL::Digest.hexdigest('md5', 'str')
21
+ # OpenSSL::Digest::Digest.new('md5')
22
+ # OpenSSL::Digest::Digest.hexdigest('md5', 'str')
23
+ # OpenSSL::Digest::Digest.new(:MD5)
24
+ # OpenSSL::Digest::Digest.hexdigest(:MD5, 'str')
25
+ def_node_matcher :insecure_digest?, <<-PATTERN
26
+ (send
27
+ (const _ {:Digest :HMAC})
28
+ #not_just_encoding?
29
+ #insecure_algorithm?
30
+ ...)
31
+ PATTERN
32
+
33
+ # Matches calls like "Digest(:MD5)".
34
+ def_node_matcher :insecure_hash_lookup?, <<-PATTERN
35
+ (send _ :Digest #insecure_algorithm?)
36
+ PATTERN
37
+
38
+ # Matches calls like "OpenSSL::HMAC.new(secret, hash)"
39
+ def_node_matcher :openssl_hmac_new?, <<-PATTERN
40
+ (send (const (const _ :OpenSSL) :HMAC) :new ...)
41
+ PATTERN
42
+
43
+ # Matches calls like "OpenSSL::HMAC.new(secret, 'sha1')"
44
+ def_node_matcher :openssl_hmac_new_insecure?, <<-PATTERN
45
+ (send (const (const _ :OpenSSL) :HMAC) :new _ #insecure_algorithm?)
46
+ PATTERN
47
+
48
+ # Matches Rails's Digest::UUID.
49
+ def_node_matcher :digest_uuid?, <<-PATTERN
50
+ (const (const _ :Digest) :UUID)
51
+ PATTERN
52
+
53
+ def_node_matcher :uuid_v3?, <<-PATTERN
54
+ (send (const _ :UUID) :uuid_v3 ...)
55
+ PATTERN
56
+
57
+ def_node_matcher :uuid_v5?, <<-PATTERN
58
+ (send (const _ :UUID) :uuid_v5 ...)
59
+ PATTERN
60
+
61
+ def insecure_algorithm?(val)
62
+ return false if val == :Digest # Don't match "Digest::Digest".
63
+
64
+ case alg_name(val)
65
+ when *allowed_hash_functions, Symbol
66
+ false
67
+ else
68
+ true
69
+ end
70
+ end
71
+
72
+ def not_just_encoding?(val)
73
+ !just_encoding?(val)
74
+ end
75
+
76
+ def just_encoding?(val)
77
+ %i[hexencode bubblebabble].include?(val)
78
+ end
79
+
80
+ DEFAULT_ALLOWED = %w[
81
+ SHA256
82
+ SHA384
83
+ SHA512
84
+ ].freeze
85
+
86
+ def allowed_hash_functions
87
+ @allowed_hash_functions ||= cop_config.fetch('Allowed', DEFAULT_ALLOWED).map(&:downcase)
88
+ end
89
+
90
+ def alg_name(val)
91
+ return :nil if val.nil?
92
+ return val.to_s.downcase unless val.is_a?(RuboCop::AST::Node)
93
+
94
+ case val.type
95
+ when :sym, :str
96
+ val.children.first.to_s.downcase
97
+ else
98
+ val.type
99
+ end
100
+ end
101
+
102
+ def on_const(const_node)
103
+ add_offense(const_node, message: default_message) if insecure_const?(const_node) && !digest_uuid?(const_node)
104
+ end
105
+
106
+ def on_send(send_node)
107
+ if uuid_v3?(send_node) && !allowed_hash_functions.include?('md5')
108
+ add_offense(send_node, message: "uuid_v3 uses MD5, which is not allowed. Prefer: #{allowed_hash_functions.join(', ')}")
109
+ elsif uuid_v5?(send_node) && !allowed_hash_functions.include?('sha1')
110
+ add_offense(send_node, message: "uuid_v5 uses SHA1, which is not allowed. Prefer: #{allowed_hash_functions.join(', ')}")
111
+ elsif openssl_hmac_new?(send_node) && openssl_hmac_new_insecure?(send_node) ||
112
+ insecure_digest?(send_node) || insecure_hash_lookup?(send_node)
113
+ add_offense(send_node, message: default_message)
114
+ end
115
+ end
116
+
117
+ def default_message
118
+ "This hash function is not allowed. Prefer: #{allowed_hash_functions.join(', ')}"
119
+ end
120
+ end
121
+ end
122
+ end
123
+ end
data/lib/rubocop/cop/cobalt.rb ADDED
@@ -0,0 +1,3 @@
1
+ # frozen_string_literal: true
2
+
3
+ require 'rubocop/cop/cobalt/insecure_hash_algorithm'
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: cobalt-rubocop
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.1.0
4
+ version: 0.5.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Cobalt Engineering
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2021-02-10 00:00:00.000000000 Z
11
+ date: 2022-01-25 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: rubocop
@@ -16,70 +16,84 @@ dependencies:
16
16
  requirements:
17
17
  - - '='
18
18
  - !ruby/object:Gem::Version
19
- version: 1.9.1
19
+ version: 1.25.0
20
20
  type: :runtime
21
21
  prerelease: false
22
22
  version_requirements: !ruby/object:Gem::Requirement
23
23
  requirements:
24
24
  - - '='
25
25
  - !ruby/object:Gem::Version
26
- version: 1.9.1
26
+ version: 1.25.0
27
27
  - !ruby/object:Gem::Dependency
28
28
  name: rubocop-performance
29
29
  requirement: !ruby/object:Gem::Requirement
30
30
  requirements:
31
31
  - - '='
32
32
  - !ruby/object:Gem::Version
33
- version: 1.9.2
33
+ version: 1.13.2
34
34
  type: :runtime
35
35
  prerelease: false
36
36
  version_requirements: !ruby/object:Gem::Requirement
37
37
  requirements:
38
38
  - - '='
39
39
  - !ruby/object:Gem::Version
40
- version: 1.9.2
40
+ version: 1.13.2
41
41
  - !ruby/object:Gem::Dependency
42
42
  name: rubocop-rails
43
43
  requirement: !ruby/object:Gem::Requirement
44
44
  requirements:
45
45
  - - '='
46
46
  - !ruby/object:Gem::Version
47
- version: 2.9.1
47
+ version: 2.13.2
48
48
  type: :runtime
49
49
  prerelease: false
50
50
  version_requirements: !ruby/object:Gem::Requirement
51
51
  requirements:
52
52
  - - '='
53
53
  - !ruby/object:Gem::Version
54
- version: 2.9.1
54
+ version: 2.13.2
55
55
  - !ruby/object:Gem::Dependency
56
56
  name: rubocop-rspec
57
57
  requirement: !ruby/object:Gem::Requirement
58
58
  requirements:
59
59
  - - '='
60
60
  - !ruby/object:Gem::Version
61
- version: 2.2.0
61
+ version: 2.8.0
62
62
  type: :runtime
63
63
  prerelease: false
64
64
  version_requirements: !ruby/object:Gem::Requirement
65
65
  requirements:
66
66
  - - '='
67
67
  - !ruby/object:Gem::Version
68
- version: 2.2.0
68
+ version: 2.8.0
69
69
  - !ruby/object:Gem::Dependency
70
70
  name: bundler
71
71
  requirement: !ruby/object:Gem::Requirement
72
72
  requirements:
73
73
  - - '='
74
74
  - !ruby/object:Gem::Version
75
- version: 2.2.2
75
+ version: 2.2.16
76
76
  type: :development
77
77
  prerelease: false
78
78
  version_requirements: !ruby/object:Gem::Requirement
79
79
  requirements:
80
80
  - - '='
81
81
  - !ruby/object:Gem::Version
82
- version: 2.2.2
82
+ version: 2.2.16
83
+ - !ruby/object:Gem::Dependency
84
+ name: rspec
85
+ requirement: !ruby/object:Gem::Requirement
86
+ requirements:
87
+ - - '='
88
+ - !ruby/object:Gem::Version
89
+ version: 3.10.0
90
+ type: :development
91
+ prerelease: false
92
+ version_requirements: !ruby/object:Gem::Requirement
93
+ requirements:
94
+ - - '='
95
+ - !ruby/object:Gem::Version
96
+ version: 3.10.0
83
97
  description: Ruby code linting for Cobalt Ruby repositories
84
98
  email:
85
99
  executables: []
@@ -92,6 +106,9 @@ files:
92
106
  - config/default.yml
93
107
  - config/rails.yml
94
108
  - config/rspec.yml
109
+ - lib/rubocop/cobalt/version.rb
110
+ - lib/rubocop/cop/cobalt.rb
111
+ - lib/rubocop/cop/cobalt/insecure_hash_algorithm.rb
95
112
  homepage: https://github.com/cobalthq/cobalt-rubocop
96
113
  licenses:
97
114
  - MIT
@@ -115,7 +132,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
115
132
  - !ruby/object:Gem::Version
116
133
  version: '0'
117
134
  requirements: []
118
- rubygems_version: 3.1.2
135
+ rubygems_version: 3.2.3
119
136
  signing_key:
120
137
  specification_version: 4
121
138
  summary: Cobalt RuboCop