rubocop-gitlab-security 0.0.5 → 0.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 2e1fe57d15469d24c90209220a37540eb886cdd7
-  data.tar.gz: 5731689f88cac6519849b5c4d077705f6e814786
+  metadata.gz: b7ac22afdb92ac5afb935e234c7f3b431a3f7a51
+  data.tar.gz: 776a00f300e5caca9a23464e7f164538750a5405
 SHA512:
-  metadata.gz: 0495dbd2a6a58e6287f254bd94902d41ce7ec9464ef3544b9fe10cc681508278c0bc37a6d042cebb88cfcae551ff1c074f8d76c814ce47b8325ab5ace6387fdb
-  data.tar.gz: 7d9034db66ba383b9f4858954922ab80c897f4092985da4a74784775aa35ef5c0def2313a0f0f6381af3c5d1e87b6d5bcf8a67538a31617c182ad39aecab4ca3
+  metadata.gz: 0dd34aa9d265e3227bddc9838b9bd440a684e80c15a3dbc3ba97ecc81a0ab67d4d2762946e91b3fbc1a912d09e6e7ea5728c187e3ae3fe4199ab1038d2f26448
+  data.tar.gz: 3b60bd1a693361e7ba723044851013983904ccf8471339841d70b03bb831f5e8d00c68ecbb3be864f041f931d722a81b5753fa0843e4dd0c32158aa6fc750fdf

data/lib/rubocop/cop/gitlab-security/public_send.rb

@@ -5,12 +5,12 @@ module RuboCop
       #
       # If passed untrusted input these methods can be used to execute arbitrary methods on behalf
       # of an attacker.
-      # 
+      #
       # @example
       #
       #   # bad
       #   myobj.public_send("#{params[:foo]}")
-      # 
+      #
       #   # good
       #   case params[:foo].to_s
       #   when 'choice1'
@@ -22,11 +22,14 @@ module RuboCop
       #   end
       #
       class PublicSend < RuboCop::Cop::Cop
-        MSG = 'Avoid using `send`'
+        MSG = "Avoid using `%s`. If this method is not passed user input it can be white-listed
+        by adding `#rubocop:disable GitlabSecurity/PublicSend`"
 
         def on_send(node)
           return unless node.command?(:send) || node.command?(:public_send)
-          add_offense(node, :selector)
+
+          append_error = node.command?(:send) ? "send()" : "public_send()"
+          add_offense(node, :selector, format(MSG, append_error))
         end
       end
     end

data/lib/rubocop/cop/gitlab-security/send_file_params.rb

@@ -4,21 +4,23 @@ module RuboCop
       # Check for use of send_file(..., params[], ...)
       #
       # Passing user params to the send_file() method allows directory traversal
-      # 
+      #
       # @example
       #
       #   # bad
       #   send_file("/tmp/myproj/" + params[:filename])
-      # 
+      #
       #   # good (verify directory)
-      
+
       #   basename = File.expand_path("/tmp/myproj")
       #   filename = File.expand_path(File.join(basename, @file.public_filename))
       #   raise if basename != filename
       #   send_file filename, disposition: 'inline'
       #
       class SendFileParams < RuboCop::Cop::Cop
-        MSG = 'Do not pass user provided params directly to send_file(), verify the path with file.expand_path() first.'
+        MSG = 'Do not pass user provided params directly to send_file(), verify
+        the path with file.expand_path() first. If the path has already been verified
+        this warning can be disabled using `#rubocop:disable GitlabSecurity/SendFileParams`'
 
         def_node_search :params_node?, <<-PATTERN
            (send (send nil :params) ... )

data/lib/rubocop/cop/gitlab-security/sql_injection.rb

@@ -4,19 +4,20 @@ module RuboCop
       # Check for use of where("name = '#{params[:name]}'")
       #
       # Passing user input to where() without parameterization can result in SQL Injection
-      # 
+      #
       # @example
       #
       #   # bad
       #   u = User.where("name = '#{params[:name]}'")
-      # 
+      #
       #   # good (parameters)
       #   u = User.where("name = ? AND id = ?", params[:name], params[:id])
       #   u = User.where(name: params[:name], id: params[:id])
       #
       class SqlInjection < RuboCop::Cop::Cop
-        MSG = 'Parameterize all user-input passed to where(), do not directly embed user input in SQL queries'
-   
+        MSG = 'Parameterize all user-input passed to where(), do not directly embed user input in SQL queries.
+        If this warning is in error you can white-list the line with `#rubocop:disable GitlabSecurity/SqlInjection`'
+
         def_node_matcher :where_user_input?, <<-PATTERN
           (send _ :where ...)
         PATTERN

data/lib/rubocop/cop/gitlab-security/system_command_injection.rb

@@ -4,20 +4,21 @@ module RuboCop
       # Check for use of system("/bin/ls #{params[:file]}")
       #
       # Passing user input to system() without sanitization and parameterization can result in command injection
-      # 
+      #
       # @example
       #
       #   # bad
       #   system("/bin/ls #{filename}")
-      # 
+      #
       #   # good (parameters)
       #   system("/bin/ls", filename)
       #   # even better
       #   exec("/bin/ls", shell_escape(filename))
       #
       class SystemCommandInjection < RuboCop::Cop::Cop
-        MSG = 'Do not include variables in the command name for system(). Use parameters "system(cmd, params)" or exec() instead.'
-   
+        MSG = 'Do not include variables in the command name for system(). Use parameters "system(cmd, params)" or exec() instead.
+        If this warning is in error you can white-list the line with `#rubocop:disable GitLabSecurity/SystemCommandInjection`'
+
         def_node_matcher :system_var?, <<-PATTERN
           (dstr (str ...) (begin ...) ...)
         PATTERN

data/lib/rubocop/gitlab-security/version.rb

@@ -4,7 +4,7 @@ module RuboCop
   module GitlabSecurity
     # Version information for the GitlabSecurity Rubocop  plugin.
     module Version
-      STRING = '0.0.5'.freeze
+      STRING = '0.0.6'.freeze
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rubocop-gitlab-security
 version: !ruby/object:Gem::Version
-  version: 0.0.5
+  version: 0.0.6
 platform: ruby
 authors:
 - Brian Neel
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-07-10 00:00:00.000000000 Z
+date: 2017-07-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rubocop