rubbycop 0.49.0

data/lib/rubbycop/cop/rails/uniq_before_pluck.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+module RubbyCop
+  module Cop
+    module Rails
+      # Prefer the use of uniq (or distinct), before pluck instead of after.
+      #
+      # The use of uniq before pluck is preferred because it executes within
+      # the database.
+      #
+      # @example
+      #   # bad
+      #   Model.pluck(:id).uniq
+      #
+      #   # good
+      #   Model.uniq.pluck(:id)
+      #
+      # This cop has two different enforcement modes. When the EnforcedStyle
+      # is conservative (the default) then only calls to pluck on a constant
+      # (i.e. a model class) before uniq are added as offenses.
+      #
+      # When the EnforcedStyle is aggressive then all calls to pluck before
+      # uniq are added as offenses. This may lead to false positives as the cop
+      # cannot distinguish between calls to pluck on an ActiveRecord::Relation
+      # vs a call to pluck on an ActiveRecord::Associations::CollectionProxy.
+      #
+      # @example
+      #   # this will return a Relation that pluck is called on
+      #   Model.where(...).pluck(:id).uniq
+      #
+      #   # an association on an instance will return a CollectionProxy
+      #   instance.assoc.pluck(:id).uniq
+      #
+      # Autocorrect is disabled by default for this cop since it may generate
+      # false positives.
+      #
+      class UniqBeforePluck < RubbyCop::Cop::Cop
+        include ConfigurableEnforcedStyle
+
+        MSG = 'Use `%s` before `pluck`.'.freeze
+        NEWLINE = "\n".freeze
+        PATTERN = '[!^block (send (send %s :pluck ...) ${:uniq :distinct} ...)]'
+                  .freeze
+
+        def_node_matcher :conservative_node_match,
+                         format(PATTERN, 'const')
+
+        def_node_matcher :aggressive_node_match,
+                         format(PATTERN, '_')
+
+        def on_send(node)
+          method = if style == :conservative
+                     conservative_node_match(node)
+                   else
+                     aggressive_node_match(node)
+                   end
+
+          add_offense(node, :selector, format(MSG, method)) if method
+        end
+
+        def autocorrect(node)
+          lambda do |corrector|
+            method = node.method_name
+
+            corrector.remove(dot_method_with_whitespace(method, node))
+            corrector.insert_before(node.receiver.loc.dot.begin, ".#{method}")
+          end
+        end
+
+        private
+
+        def style_parameter_name
+          'EnforcedStyle'
+        end
+
+        def dot_method_with_whitespace(method, node)
+          range_between(dot_method_begin_pos(method, node),
+                        node.loc.selector.end_pos)
+        end
+
+        def dot_method_begin_pos(method, node)
+          lines = node.source.split(NEWLINE)
+
+          if lines.last.strip == ".#{method}"
+            node.source.rindex(NEWLINE)
+          else
+            node.loc.dot.begin_pos
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubbycop/cop/rails/validation.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module RubbyCop
+  module Cop
+    module Rails
+      # This cop checks for the use of old-style attribute validation macros.
+      class Validation < Cop
+        MSG = 'Prefer the new style validations `%s` over `%s`.'.freeze
+
+        TYPES = %w[
+          acceptance
+          confirmation
+          exclusion
+          format
+          inclusion
+          length
+          numericality
+          presence
+          size
+          uniqueness
+        ].freeze
+
+        BLACKLIST = TYPES.map { |p| "validates_#{p}_of".to_sym }.freeze
+        WHITELIST = TYPES.map { |p| "validates :column, #{p}: value" }.freeze
+
+        def on_send(node)
+          return unless !node.receiver && BLACKLIST.include?(node.method_name)
+
+          add_offense(node, :selector)
+        end
+
+        private
+
+        def message(node)
+          format(MSG, preferred_method(node.method_name), node.method_name)
+        end
+
+        def preferred_method(method)
+          WHITELIST[BLACKLIST.index(method.to_sym)]
+        end
+
+        def autocorrect(node)
+          lambda do |corrector|
+            corrector.replace(node.loc.selector, 'validates')
+            correct_validate_type(corrector, node)
+          end
+        end
+
+        def correct_validate_type(corrector, node)
+          options = node.arguments.find { |arg| !arg.sym_type? }
+          validate_type = node.method_name.to_s.split('_')[1]
+
+          if options
+            corrector.replace(options.loc.expression,
+                              "#{validate_type}: { #{options.source} }")
+          else
+            corrector.insert_after(node.loc.expression,
+                                   ", #{validate_type}: true")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubbycop/cop/registry.rb

@@ -0,0 +1,171 @@
+# frozen_string_literal: true
+
+module RubbyCop
+  module Cop
+    # Error raised when an unqualified cop name is used that could
+    # refer to two or more cops under different departments
+    class AmbiguousCopName < RubbyCop::Error
+      MSG = 'Ambiguous cop name `%<name>s` used in %<origin>s needs ' \
+            'department qualifier. Did you mean %<options>s?'.freeze
+
+      def initialize(name, origin, badges)
+        super(
+          format(
+            MSG,
+            name: name,
+            origin: origin,
+            options: badges.to_a.join(' or ')
+          )
+        )
+      end
+    end
+
+    # Registry that tracks all cops by their badge and department.
+    class Registry
+      def initialize(cops = [])
+        @registry    = {}
+        @departments = {}
+
+        cops.each { |cop| enlist(cop) }
+      end
+
+      def enlist(cop)
+        @registry[cop.badge] = cop
+        @departments[cop.department] ||= []
+        @departments[cop.department] << cop
+      end
+
+      # @return [Array<Symbol>] list of departments for current cops.
+      def departments
+        @departments.keys
+      end
+
+      # @return [Registry] Cops for that specific department.
+      def with_department(department)
+        with(@departments.fetch(department, []))
+      end
+
+      # @return [Registry] Cops not for a specific department.
+      def without_department(department)
+        without_department = @departments.dup
+        without_department.delete(department)
+
+        with(without_department.values.flatten)
+      end
+
+      def contains_cop_matching?(names)
+        cops.any? { |cop| cop.match?(names) }
+      end
+
+      # Convert a user provided cop name into a properly namespaced name
+      #
+      # @example gives back a correctly qualified cop name
+      #
+      #   cops = RubbyCop::Cop::Cop.all
+      #   cops.
+      #     qualified_cop_name('Layout/IndentArray') # => 'Layout/IndentArray'
+      #
+      # @example fixes incorrect namespaces
+      #
+      #   cops = RubbyCop::Cop::Cop.all
+      #   cops.qualified_cop_name('Lint/IndentArray') # => 'Layout/IndentArray'
+      #
+      # @example namespaces bare cop identifiers
+      #
+      #   cops = RubbyCop::Cop::Cop.all
+      #   cops.qualified_cop_name('IndentArray') # => 'Layout/IndentArray'
+      #
+      # @example passes back unrecognized cop names
+      #
+      #   cops = RubbyCop::Cop::Cop.all
+      #   cops.qualified_cop_name('NotACop') # => 'NotACop'
+      #
+      # @param name [String] Cop name extracted from config
+      # @param path [String, nil] Path of file that `name` was extracted from
+      #
+      # @raise [AmbiguousCopName]
+      #   if a bare identifier with two possible namespaces is provided
+      #
+      # @note Emits a warning if the provided name has an incorrect namespace
+      #
+      # @return [String] Qualified cop name
+      def qualified_cop_name(name, path)
+        badge = Badge.parse(name)
+        return name if registered?(badge)
+
+        potential_badges = qualify_badge(badge)
+
+        case potential_badges.size
+        when 0 then name # No namespace found. Deal with it later in caller.
+        when 1 then resolve_badge(badge, potential_badges.first, path)
+        else raise AmbiguousCopName.new(badge, path, potential_badges)
+        end
+      end
+
+      def to_h
+        cops.group_by(&:cop_name)
+      end
+
+      def cops
+        @registry.values
+      end
+
+      def length
+        @registry.size
+      end
+
+      def enabled(config, only)
+        select do |cop|
+          config.for_cop(cop).fetch('Enabled') || only.include?(cop.cop_name)
+        end
+      end
+
+      def names
+        cops.map(&:cop_name)
+      end
+
+      def ==(other)
+        cops == other.cops
+      end
+
+      def sort!
+        @registry = Hash[@registry.sort_by { |badge, _| badge.cop_name }]
+
+        self
+      end
+
+      def select(&block)
+        cops.select(&block)
+      end
+
+      def each(&block)
+        cops.each(&block)
+      end
+
+      private
+
+      def with(cops)
+        self.class.new(cops)
+      end
+
+      def qualify_badge(badge)
+        @departments
+          .map { |department, _| badge.with_department(department) }
+          .select { |potential_badge| registered?(potential_badge) }
+      end
+
+      def resolve_badge(given_badge, real_badge, source_path)
+        unless given_badge.match?(real_badge)
+          warn "#{source_path}: #{given_badge} has the wrong namespace - " \
+               "should be #{real_badge.department}"
+        end
+
+        real_badge.to_s
+      end
+
+      def registered?(badge)
+        @registry.key?(badge)
+      end
+    end
+  end
+end

data/lib/rubbycop/cop/security/eval.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module RubbyCop
+  module Cop
+    module Security
+      # This cop checks for the use of `Kernel#eval` and `Binding#eval`.
+      #
+      # @example
+      #
+      #   # bad
+      #
+      #   eval(something)
+      #   binding.eval(something)
+      class Eval < Cop
+        MSG = 'The use of `eval` is a serious security risk.'.freeze
+
+        def_node_matcher :eval?, <<-END
+          (send {nil (send nil :binding)} :eval $!str ...)
+        END
+
+        def on_send(node)
+          eval?(node) do |code|
+            return if code.dstr_type? && code.recursive_literal?
+            add_offense(node, :selector)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubbycop/cop/security/json_load.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module RubbyCop
+  module Cop
+    module Security
+      # This cop checks for the use of JSON class methods which have potential
+      # security issues.
+      #
+      # Autocorrect is disabled by default because it's potentially dangerous.
+      # If using a stream, like `JSON.load(open('file'))`, it will need to call
+      # `#read` manually, like `JSON.parse(open('file').read)`.
+      # If reading single values (rather than proper JSON objects), like
+      # `JSON.load('false')`, it will need to pass the `quirks_mode: true`
+      # option, like `JSON.parse('false', quirks_mode: true)`.
+      # Other similar issues may apply.
+      #
+      # @example
+      #   # always offense
+      #   JSON.load("{}")
+      #   JSON.restore("{}")
+      #
+      #   # no offense
+      #   JSON.parse("{}")
+      #
+      class JSONLoad < Cop
+        MSG = 'Prefer `JSON.parse` over `JSON.%s`.'.freeze
+
+        def_node_matcher :json_load, <<-END
+          (send (const {nil cbase} :JSON) ${:load :restore} ...)
+        END
+
+        def on_send(node)
+          json_load(node) do |method|
+            add_offense(node, :selector, format(MSG, method))
+          end
+        end
+
+        def autocorrect(node)
+          ->(corrector) { corrector.replace(node.loc.selector, 'parse') }
+        end
+      end
+    end
+  end
+end

data/lib/rubbycop/cop/security/marshal_load.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module RubbyCop
+  module Cop
+    module Security
+      # This cop checks for the use of Marshal class methods which have
+      # potential security issues leading to remote code execution when
+      # loading from an untrusted source.
+      #
+      # @example
+      #   # bad
+      #   Marshal.load("{}")
+      #   Marshal.restore("{}")
+      #
+      #   # good
+      #   Marshal.dump("{}")
+      #
+      #   # okish - deep copy hack
+      #   Marshal.load(Marshal.dump({}))
+      #
+      class MarshalLoad < Cop
+        MSG = 'Avoid using `Marshal.%s`.'.freeze
+
+        def_node_matcher :marshal_load, <<-END
+          (send (const {nil cbase} :Marshal) ${:load :restore}
+          !(send (const {nil cbase} :Marshal) :dump ...))
+        END
+
+        def on_send(node)
+          marshal_load(node) do |method|
+            add_offense(node, :selector, format(MSG, method))
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubbycop/cop/security/yaml_load.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module RubbyCop
+  module Cop
+    module Security
+      # This cop checks for the use of YAML class methods which have
+      # potential security issues leading to remote code execution when
+      # loading from an untrusted source.
+      #
+      # @example
+      #   # bad
+      #   YAML.load("--- foo")
+      #
+      #   # good
+      #   YAML.safe_load("--- foo")
+      #   YAML.dump("foo")
+      #
+      class YAMLLoad < Cop
+        MSG = 'Prefer using `YAML.safe_load` over `YAML.load`.'.freeze
+
+        def_node_matcher :yaml_load, <<-END
+          (send (const {nil cbase} :YAML) :load ...)
+        END
+
+        def on_send(node)
+          yaml_load(node) do
+            add_offense(node, :selector)
+          end
+        end
+
+        def autocorrect(node)
+          ->(corrector) { corrector.replace(node.loc.selector, 'safe_load') }
+        end
+      end
+    end
+  end
+end