rubocop-dev_doc 0.9.0 → 0.10.1

data/lib/rubocop/cop/dev_doc/style/avoid_send.rb

@@ -1,95 +0,0 @@
-module RuboCop
-  module Cop
-    module DevDoc
-      module Style
-        # Avoid dynamic `send` and `public_send` with an explicit receiver.
-        #
-        # ## Rationale
-        # `send()` can call *any* method, including destructive ones like
-        # `destroy`. The risk is specifically with **dynamic** method names —
-        # when the argument is a variable or interpolated string, a crafted
-        # value could invoke methods the developer never intended to expose.
-        #
-        # **Literal symbol arguments are exempt** — the method name is fixed at
-        # code-write time and visible to reviewers, equivalent to a direct call.
-        #
-        # ## Safer alternatives
-        #
-        # **a) For model attributes — use bracket notation instead.**
-        # `@model[column_name]` only accesses database columns, so it cannot
-        # accidentally invoke methods like `destroy`.
-        #
-        #   ❌ Dangerous — method_name could be :destroy or any other method
-        #   @user.send(method_name)
-        #
-        #   ✔️ Safe — only accesses database columns
-        #   @user[method_name]
-        #
-        # **b) For non-model objects — use a prefix to restrict callable methods.**
-        # By interpolating the dynamic part into a fixed prefix, only methods
-        # with that prefix (e.g. `export_csv`, `export_pdf`) can be invoked,
-        # preventing accidental calls to unintended methods.
-        #
-        #   ❌ Unrestricted — any method can be called
-        #   obj.send(method_name)
-        #
-        #   ✔️ Restricted — only methods with the prefix can be called
-        #   obj.send("export_#{method_name}")
-        #
-        # NOTE: A prefix narrows the callable surface but does not eliminate it —
-        # an attacker-controlled suffix can still reach any method sharing the
-        # prefix (e.g. `"export_#{x}"` could hit `export_and_destroy`). Use the
-        # narrowest prefix that fits, and prefer an explicit whitelist when the
-        # set of targets is small.
-        #
-        # @example
-        #   # bad — dynamic method name from a variable
-        #   @user.send(method_name)
-        #   obj.public_send(action)
-        #
-        #   # bad — interpolation with no static prefix restricts nothing
-        #   obj.send("#{x}")
-        #   obj.send("#{x}_run")
-        #
-        #   # good — literal symbol: method name is statically visible
-        #   instance.send(:private_helper, arg)
-        #
-        #   # good — bracket notation for model attributes
-        #   @user[attribute_name]
-        #
-        #   # good — static prefix restricts the callable methods
-        #   obj.send("export_#{method_name}")
-        class AvoidSend < Base
-          MSG = "Avoid dynamic `%<method>s` — use bracket notation for model attributes, " \
-                "or a prefix (`obj.send(\"export_\#{x}\")`) to restrict callable methods.".freeze
-          # `__send__` is the canonical alias — omitting it would leave a
-          # zero-cost dodge for the exact dynamic dispatch this cop restricts.
-          RESTRICT_ON_SEND = %i[send public_send __send__].freeze
-
-          def on_send(node)
-            return if node.receiver.nil?
-
-            arg = node.first_argument
-            return if arg&.sym_type?
-            return if prefixed_dynamic_method?(arg)
-
-            add_offense(node.loc.selector, message: format(MSG, method: node.method_name))
-          end
-
-          private
-
-          # A dynamic string/symbol that begins with a static prefix (e.g.
-          # `"export_#{x}"`) restricts the callable surface to methods sharing
-          # that prefix, so it is exempt. Pure interpolation (`"#{x}"`) or a
-          # trailing prefix (`"#{x}_run"`) restricts nothing and is still flagged.
-          def prefixed_dynamic_method?(arg)
-            return false unless arg&.type?(:dstr, :dsym)
-
-            first = arg.children.first
-            first&.str_type? && !first.value.empty?
-          end
-        end
-      end
-    end
-  end
-end