rubocop-highlands 1.0.0

data/lib/rubocop/cop/highlands/simple_modifier_conditional.rb

@@ -0,0 +1,23 @@
+module RuboCop
+  module Cop
+    module Highlands
+      # Cop to tackle prevent more complicated modifier if/unless statements
+      # https://github.com/highlands/ruby#only-simple-if-unless
+      class SimpleModifierConditional < Cop
+        MSG = 'Modifier if/unless usage is okay when the body is simple, ' \
+          'the condition is simple, and the whole thing fits on one line. ' \
+          'Otherwise, avoid modifier if/unless.'.freeze
+
+        def_node_matcher :multiple_conditionals?, '(if ({and or :^} ...) ...)'
+
+        def on_if(node)
+          return unless node.modifier_form?
+
+          if multiple_conditionals?(node) || node.multiline?
+            add_offense(node)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/highlands/simple_unless.rb

@@ -0,0 +1,19 @@
+module RuboCop
+  module Cop
+    module Highlands
+      # Cop to tackle prevent unless statements with multiple conditions
+      # https://github.com/highlands/ruby#unless-with-multiple-conditions
+      class SimpleUnless < Cop
+        MSG = 'Unless usage is okay when there is only one conditional'.freeze
+
+        def_node_matcher :multiple_conditionals?, '(if ({and or :^} ...) ...)'
+
+        def on_if(node)
+          return unless node.unless?
+
+          add_offense(node) if multiple_conditionals?(node)
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/highlands/spec_constant_assignment.rb

@@ -0,0 +1,55 @@
+require 'rubocop-rspec'
+
+module RuboCop
+  module Cop
+    module Highlands
+      # This cop checks for constant assignment inside of specs
+      #
+      # @example
+      #   # bad
+      #   describe Something do
+      #     PAYLOAD = [1, 2, 3]
+      #   end
+      #
+      #   # good
+      #   describe Something do
+      #     let(:payload)  { [1, 2, 3] }
+      #   end
+      #
+      #   # bad
+      #   describe Something do
+      #     MyClass::PAYLOAD = [1, 2, 3]
+      #   end
+      #
+      #   # good
+      #   describe Something do
+      #     before { stub_const('MyClass::PAYLOAD', [1, 2, 3])
+      #   end
+      class SpecConstantAssignment < Cop
+        include RuboCop::RSpec::TopLevelDescribe
+        MESSAGE = "Defining constants inside of specs can cause spurious behavior. " \
+                  "It is almost always preferable to use `let` statements, "\
+                  "anonymous class/module definitions, or stub_const".freeze
+
+        def on_casgn(node)
+          return unless in_spec_file?(node)
+          parent_module_name = node.parent_module_name
+          if node.parent_module_name && parent_module_name != 'Object'
+            return
+          end
+          add_offense(node, message: MESSAGE)
+        end
+
+        private
+
+        def in_spec_file?(node)
+          filename = node.location.expression.source_buffer.name
+
+          # For tests, the input is a string
+          return true if filename == "(string)"
+          filename.include?("/spec/")
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/highlands/unsafe_yaml_marshal.rb

@@ -0,0 +1,47 @@
+module RuboCop
+  module Cop
+    module Highlands
+      # Disallow use of YAML/Marshal methods that can trigger RCE on untrusted input
+      class UnsafeYamlMarshal < Cop
+        MSG = 'Using unsafe YAML parsing methods on untrusted input can lead ' \
+              'to remote code execution. Use `safe_load`, `parse`, `parse_file`, or ' \
+              '`parse_stream` instead'.freeze
+
+        def on_send(node)
+          receiver, method_name, *_args = *node
+
+          return if receiver.nil?
+          return unless receiver.const_type?
+
+          check_yaml(node, receiver, method_name, *_args)
+          check_marshal(node, receiver, method_name, *_args)
+        rescue => e
+          puts e
+          puts e.backtrace
+          raise
+        end
+
+        def check_yaml(node, receiver, method_name, *_args)
+          return unless ['YAML', 'Psych'].include?(receiver.const_name)
+          return unless [:load, :load_documents, :load_file, :load_stream].include?(method_name)
+
+          message = "Using `#{receiver.const_name}.#{method_name}` on untrusted input can lead " \
+            "to remote code execution. Use `safe_load`, `parse`, `parse_file`, or " \
+            "`parse_stream` instead"
+
+          add_offense(node, message: message)
+        end
+
+        def check_marshal(node, receiver, method_name, *_args)
+          return unless receiver.const_name == 'Marshal'
+          return unless method_name == :load
+
+          message = 'Using `Marshal.load` on untrusted input can lead to remote code execution. ' \
+            'Restructure your code to not use Marshal'
+
+          add_offense(node, message: message)
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/highlands.rb

@@ -0,0 +1,16 @@
+require 'pathname'
+require 'psych'
+
+Dir.glob(File.expand_path('cop/**/*.rb', File.dirname(__FILE__))).map(&method(:require))
+
+module RuboCop
+  # RuboCop Highlands project namespace
+  module Highlands
+    PROJECT_ROOT =
+      Pathname.new(__FILE__).parent.parent.parent.expand_path.freeze
+    CONFIG_DEFAULT = PROJECT_ROOT.join('config', 'default.yml').freeze
+    CONFIG = Psych.safe_load(CONFIG_DEFAULT.read).freeze
+
+    private_constant(*constants(false))
+  end
+end

data/lib/rubocop/highlands/inflections.rb

@@ -0,0 +1,14 @@
+# String inflections copied over from ActiveSupport
+module Inflections
+  # Convert Foo::BarBaz to foo/bar_baz.
+  # Copied from ActiveSupport.
+  def underscore(camel_cased_word)
+    word = camel_cased_word.to_s.dup
+    word.gsub!(/::/, '/')
+    word.gsub!(/([A-Z]+)([A-Z][a-z])/, '\1_\2')
+    word.gsub!(/([a-z\d])([A-Z])/, '\1_\2')
+    word.tr!("-", "_")
+    word.downcase!
+    word
+  end
+end

data/lib/rubocop/highlands/inject.rb

@@ -0,0 +1,20 @@
+# Straight up ripped from the custom Rspec rubocop
+# https://github.com/nevir/rubocop-rspec/blob/master/lib/rubocop/rspec/inject.rb
+require 'yaml'
+
+module RuboCop
+  module Highlands
+    # Because RuboCop doesn't yet support plugins, we have to monkey patch in a
+    # bit of our configuration.
+    module Inject
+      def self.defaults!
+        path = CONFIG_DEFAULT.to_s
+        hash = ConfigLoader.load_file(path).to_hash
+        config = Config.new(hash, path)
+        puts "configuration from #{path}" if ConfigLoader.debug?
+        config = ConfigLoader.merge_with_default(config, path)
+        ConfigLoader.instance_variable_set(:@default_configuration, config)
+      end
+    end
+  end
+end

data/lib/rubocop/highlands/rails_autoloading.rb

@@ -0,0 +1,55 @@
+# These methods are useful for Rubocop rules related to Rails autoloading.
+module RailsAutoloading
+  def run_rails_autoloading_cops?(path)
+    return false unless config["Rails".freeze]
+    return false unless config["Rails".freeze]["Enabled".freeze]
+
+    # Ignore rake tasks
+    return false unless path.end_with?(".rb")
+
+    true
+  end
+
+  # Given "foo/bar/baz", return:
+  # [
+  #   %r{/foo.rb$},
+  #   %r{/foo/bar.rb$},
+  #   %r{/foo/bar/baz.rb$},
+  #   %r{/foo/bar/baz/}, # <= only if allow_dir = true
+  # ]
+  def allowable_paths_for(expected_dir, options = {})
+    options = { allow_dir: false }.merge(options)
+    allowable_paths = []
+    next_slash = expected_dir.index("/")
+    while next_slash
+      allowable_paths << %r{/#{expected_dir[0...next_slash]}.rb$}
+      next_slash = expected_dir.index("/", next_slash + 1)
+    end
+    allowable_paths << %r{#{expected_dir}.rb$}
+    allowable_paths << %r{/#{expected_dir}/} if options[:allow_dir]
+    allowable_paths
+  end
+
+  def normalize_module_name(module_name)
+    return '' if module_name.nil?
+    normalized_name = module_name.gsub(/#<Class:|>/, "")
+    normalized_name = "" if normalized_name == "Object"
+    normalized_name
+  end
+
+  # module_name looks like one of these:
+  #   Foo::Bar for an instance method
+  #   #<Class:Foo::Bar> for a class method.
+  # For either case we return ["Foo", "Bar"]
+  def split_modules(module_name)
+    normalize_module_name(module_name).split("::")
+  end
+
+  def full_const_name(parent_module_name, const_name)
+    if parent_module_name == "".freeze
+      "#{const_name}"
+    else
+      "#{parent_module_name}::#{const_name}"
+    end
+  end
+end

data/lib/rubocop/highlands/version.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Highlands
+    # Version information for the the Highlands RuboCop plugin.
+    VERSION = '1.0.0'.freeze
+  end
+end

data/rubocop-highlands.gemspec

@@ -0,0 +1,31 @@
+$LOAD_PATH.unshift File.expand_path('../lib', __FILE__)
+require 'rubocop/highlands/version'
+
+Gem::Specification.new do |spec|
+  spec.name = 'rubocop-highlands'
+  spec.summary = 'Custom code style checking for Church of the Highlands.'
+  spec.description = <<-EOF
+    A plugin for RuboCop code style enforcing & linting tool. It includes Rubocop configuration
+    used at Church of the Highlands and a few custom rules that have caused internal issues at
+    Church of the Highlands but are not supported by core Rubocop.
+  EOF
+  spec.authors = ['Church of the Highlands - Digital Team']
+  spec.email = ['info@churchofthehighlands.com']
+  spec.homepage = 'https://github.com/highlands/ruby'
+  spec.license = 'MIT'
+  spec.version = RuboCop::Highlands::VERSION
+  spec.platform = Gem::Platform::RUBY
+  spec.required_ruby_version = '>= 2.1'
+
+  spec.require_paths = ['lib']
+  spec.files = Dir[
+    '{config,lib,spec}/**/*',
+    '*.md',
+    '*.gemspec',
+    'Gemfile',
+  ]
+
+  spec.add_dependency('rubocop', '~> 0.58.0')
+  spec.add_dependency('rubocop-rspec', '~> 1.30.0')
+  spec.add_development_dependency('rspec', '~> 3.5')
+end

data/spec/rubocop/cop/highlands/class_name_spec.rb

@@ -0,0 +1,78 @@
+describe RuboCop::Cop::Highlands::ClassName do
+  subject(:cop) { described_class.new }
+
+  describe "belongs_to" do
+    it 'rejects with Model.name' do
+      source = [
+        'class Coupon',
+        '  belongs_to :user, :class_name => User.name',
+        'end',
+      ].join("\n")
+      inspect_source(source)
+
+      expect(cop.offenses.size).to eq(1)
+      expect(cop.offenses.map(&:line).sort).to eq([2])
+    end
+
+    it 'passes with "Model"' do
+      source = [
+        'class Coupon',
+        '  belongs_to :user, :class_name => "User"',
+        'end',
+      ].join("\n")
+      inspect_source(source)
+
+      expect(cop.offenses).to be_empty
+    end
+  end
+
+  describe "has_many" do
+    it 'rejects with Model.name' do
+      source = [
+        'class Coupon',
+        '  has_many :reservations, :class_name => Reservation2.name',
+        'end',
+      ].join("\n")
+      inspect_source(source)
+
+      expect(cop.offenses.size).to eq(1)
+      expect(cop.offenses.map(&:line)).to eq([2])
+    end
+
+    it 'passes with "Model"' do
+      source = [
+        'class Coupon',
+        '  has_many :reservations, :class_name => "Reservation2"',
+        'end',
+      ].join("\n")
+      inspect_source(source)
+
+      expect(cop.offenses).to be_empty
+    end
+  end
+
+  describe "has_one" do
+    it 'rejects with Model.name' do
+      source = [
+        'class Coupon',
+        '  has_one :loss, :class_name => Payments::Loss.name',
+        'end',
+      ].join("\n")
+      inspect_source(source)
+
+      expect(cop.offenses.size).to eq(1)
+      expect(cop.offenses.map(&:line)).to eq([2])
+    end
+
+    it 'passes with "Model"' do
+      source = [
+        'class Coupon',
+        '  has_one :loss, :class_name => "Payments::Loss"',
+        'end',
+      ].join("\n")
+      inspect_source(source)
+
+      expect(cop.offenses).to be_empty
+    end
+  end
+end

data/spec/rubocop/cop/highlands/class_or_module_declared_in_wrong_file_spec.rb

@@ -0,0 +1,174 @@
+describe RuboCop::Cop::Highlands::ClassOrModuleDeclaredInWrongFile do
+  subject(:cop) { described_class.new(config) }
+
+  let(:config) do
+    RuboCop::Config.new(
+      {
+        "Rails" => {
+          "Enabled" => true,
+        },
+      }
+    )
+  end
+
+  # Put source in a directory under /tmp because this cop cares about the filename
+  # but not the parent dir name.
+  let(:tmpdir) { Dir.mktmpdir }
+  let(:models_dir) do
+    gemfile = File.new("#{tmpdir}/Gemfile", "w")
+    gemfile.close
+    FileUtils.mkdir_p("#{tmpdir}/app/models").first
+  end
+
+  after do
+    FileUtils.rm_rf tmpdir
+  end
+
+  it 'rejects if class declaration is in a file with non-matching name' do
+    source = [
+      'module Foo',
+      '  module Bar',
+      '    class Baz',
+      '    end',
+      '  end',
+      'end',
+    ].join("\n")
+
+    File.open "#{models_dir}/qux.rb", "w" do |file|
+      inspect_source(source, file)
+    end
+
+    expect(cop.offenses.size).to eq(3)
+    expect(cop.offenses.map(&:line).sort).to eq([1, 2, 3])
+    expect(cop.offenses.first.message).to include('Module Foo should be defined in foo.rb.')
+  end
+
+  it 'rejects if class declaration is in a file with matching name but wrong parent dir' do
+    source = [
+      'module Foo',
+      '  module Bar',
+      '    class Baz',
+      '    end',
+      '  end',
+      'end',
+    ].join("\n")
+
+    File.open "#{models_dir}/baz.rb", "w" do |file|
+      inspect_source(source, file)
+    end
+
+    expect(cop.offenses.size).to eq(3)
+    expect(cop.offenses.map(&:line).sort).to eq([1, 2, 3])
+    expect(cop.offenses.last.message).to include('Class Baz should be defined in foo/bar/baz.rb.')
+  end
+
+  it 'accepts if class declaration is in a file with matching name and right parent dir' do
+    source = [
+      'module Foo',
+      '  module Bar',
+      '    class Baz',
+      '    end',
+      '  end',
+      'end',
+    ].join("\n")
+
+    FileUtils.mkdir_p "#{models_dir}/foo/bar"
+    File.open "#{models_dir}/foo/bar/baz.rb", "w" do |file|
+      inspect_source(source, file)
+    end
+
+    expect(cop.offenses).to be_empty
+  end
+
+  it 'rejects if class declaration is in wrong dir and parent module uses ::' do
+    source = [
+      'module Foo::Bar',
+      '  class Baz',
+      '  end',
+      'end',
+    ].join("\n")
+
+    FileUtils.mkdir_p "#{models_dir}/bar"
+    File.open "#{models_dir}/bar/baz.rb", "w" do |file|
+      inspect_source(source, file)
+    end
+
+    expect(cop.offenses.map(&:line).sort).to eq([1, 2])
+    expect(cop.offenses.last.message).to include('Class Baz should be defined in foo/bar/baz.rb.')
+  end
+
+  it 'accepts if class declaration is in a file with matching name and parent module uses ::' do
+    source = [
+      'module Foo::Bar',
+      '  class Baz',
+      '  end',
+      'end',
+    ].join("\n")
+
+    FileUtils.mkdir_p "#{models_dir}/foo/bar"
+    File.open "#{models_dir}/foo/bar/baz.rb", "w" do |file|
+      inspect_source(source, file)
+    end
+
+    expect(cop.offenses).to be_empty
+  end
+
+  it 'accepts class declaration where the containing class uses an acronym' do
+    source = [
+      'module CSVFoo',
+      '  class Baz',
+      '  end',
+      'end',
+    ].join("\n")
+
+    FileUtils.mkdir_p "#{models_dir}/csv_foo"
+    File.open "#{models_dir}/csv_foo/baz.rb", "w" do |file|
+      inspect_source(source, file)
+    end
+
+    expect(cop.offenses).to be_empty
+  end
+
+  it 'ignores class/module declaration in a rake task' do
+    source = [
+      'class Baz',
+      'end',
+    ].join("\n")
+
+    File.open "#{models_dir}/foo.rake", "w" do |file|
+      inspect_source(source, file)
+    end
+
+    expect(cop.offenses).to be_empty
+  end
+
+  it 'suggests moving error classes into the file that defines the owning scope' do
+    source = [
+      'module Foo',
+      '  class BarError < StandardError; end',
+      'end',
+    ].join("\n")
+
+    File.open "#{models_dir}/bar.rb", "w" do |file|
+      inspect_source(source, file)
+    end
+
+    expect(cop.offenses.map(&:line)).to include(2)
+    expect(cop.offenses.map(&:message)).to include(%r{Class BarError should be defined in foo\.rb.})
+  end
+
+  it 'recognizes error class based on the superclass name' do
+    source = [
+      'module Foo',
+      '  class Bar < StandardError; end',
+      'end',
+    ].join("\n")
+
+    File.open "#{models_dir}/bar.rb", "w" do |file|
+      inspect_source(source, file)
+    end
+
+    expect(cop.offenses.map(&:line)).to include(2)
+    expect(cop.offenses.map(&:message)).to include(%r{Class Bar should be defined in foo\.rb.})
+  end
+end