rubocop-neeto 0.1.19 → 0.1.20

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a114d1fda0a6640c867ce32d0882d0c804d1e0b4f273d9bfcf13f35d77e8cda7
-  data.tar.gz: 0f27ddfd9cfce7a6e6499716441730003bf5f4657b650020866ba811bc7966ac
+  metadata.gz: a80cf5441b3f2e8a557f1ab80f1c33f234fd0964051e0c4ba3082ed6ad4ec038
+  data.tar.gz: ed16bab4d596c2741d0205e1a3904c9207574564df4481b7aae7fac5541427f1
 SHA512:
-  metadata.gz: 8c02805a3712d669826caa86ec47a886347bc3657e8d1d72901f3f5465babcdd9c666e76e63374b3e6ac17c52f0511fe65b2bfb4be4bc1f0eb97ea800fef6f19
-  data.tar.gz: 726009349f00e1615c5b6e4752bc4cd5be629e3b142af7fb6b3f3bd2d801203a172b70c48a05b4f252063802db1ca001526d0c54a727b676d77177ddca2b29ae
+  metadata.gz: f34434c7395250edfac2c36e73f719bbcf80f37443945e9a6e1fc31958dc1736aba5c3705eeea4f5fd455e72022e2f1e7465ce9810fc72e32a757840aaed0840
+  data.tar.gz: 4c4e0f22d50814ceb614509f44218e0733a3466eccb7674d29cc200fed15e9bed465e99c1e8f0d91d2f0a548cccb5c060b3ab65cbf98011e0d7f6aed01f73869

data/README.md

@@ -7,6 +7,12 @@
 3. [Neeto/DirectEnvAccess](https://rubocop-neeto.neetodeployapp.com/docs/RuboCop/Cop/Neeto/DirectEnvAccess)
 4. [Neeto/DeprecatedJobBaseClass](https://rubocop-neeto.neetodeployapp.com/docs/RuboCop/Cop/Neeto/DeprecatedJobBaseClass)
 5. [Neeto/FaradayOverHttparty](https://rubocop-neeto.neetodeployapp.com/docs/RuboCop/Cop/Neeto/FaradayOverHttparty)
+6. [Neeto/HtmlSafeOnDynamicString](https://rubocop-neeto.neetodeployapp.com/docs/RuboCop/Cop/Neeto/HtmlSafeOnDynamicString)
+7. [Neeto/HtmlInStringLiteral](https://rubocop-neeto.neetodeployapp.com/docs/RuboCop/Cop/Neeto/HtmlInStringLiteral)
+8. [Neeto/DirectLiquidRender](https://rubocop-neeto.neetodeployapp.com/docs/RuboCop/Cop/Neeto/DirectLiquidRender)
+9. [Neeto/HtmlTranslationInterpolation](https://rubocop-neeto.neetodeployapp.com/docs/RuboCop/Cop/Neeto/HtmlTranslationInterpolation)
+
+The HTML-safety cops (6 to 9) report at `Severity: info` while products migrate, so they show in editors and CI output without failing the build. They move to `Severity: error` once every product is migrated.
 
 ## Installation
 

data/config/default.yml

@@ -64,3 +64,66 @@ Neeto/FaradayOverHttparty:
   Include:
     - '**/Gemfile'
     - '**/Gemfile.common.rb'
+
+Neeto/HtmlSafeOnDynamicString:
+  Description: >-
+    `html_safe`, `raw` and `safe_concat` mark a string as already safe, so
+    Rails emits it without escaping. Calling them on dynamic values
+    (interpolation, method results, variables) turns off output escaping for
+    that value. Build markup with `tag`, `content_tag`, `link_to`, `mail_to`
+    or `safe_join` instead, or annotate a reviewed call with
+    `# neeto:html-safe-reviewed <reason>`.
+  Enabled: true
+  Severity: info
+  VersionAdded: '0.1'
+  Include:
+    - app/**/*.rb
+    - lib/**/*.rb
+    - app/views/**/*.erb
+    - app/views/**/*.inky
+
+Neeto/HtmlInStringLiteral:
+  Description: >-
+    Plain Ruby strings never escape what is interpolated into them. Build
+    markup outside views with `tag`, `content_tag`, `link_to`, `mail_to`,
+    `safe_join` or a partial instead of string literals and heredocs.
+  Enabled: true
+  Severity: info
+  VersionAdded: '0.1'
+  Include:
+    - app/**/*.rb
+    - lib/**/*.rb
+  Exclude:
+    - app/views/**/*
+    - lib/tasks/**/*
+
+Neeto/DirectLiquidRender:
+  Description: >-
+    `Liquid::Template#render` does not escape its output. Build and render
+    Liquid templates only through `NeetoCommonsBackend::LiquidRenderer`, which
+    escapes every output and requires an explicit format (`:html` or `:text`).
+    Check a template's syntax with `NeetoCommonsBackend::LiquidRenderer.validate!`.
+  Enabled: true
+  Severity: info
+  VersionAdded: '0.1'
+  Include:
+    - app/**/*.rb
+    - lib/**/*.rb
+
+Neeto/HtmlTranslationInterpolation:
+  Description: >-
+    `I18n.t` does not escape interpolated values, even for `_html` keys. A
+    translation that contains HTML must not interpolate unescaped values.
+    Escape each value with `ERB::Util.html_escape`, or keep the markup out of
+    the translation and build it with `tag` or `content_tag`.
+  Enabled: true
+  Severity: info
+  VersionAdded: '0.1'
+  LocaleFiles:
+    - config/locales/en.yml
+  Include:
+    - app/**/*.rb
+    - lib/**/*.rb
+  Exclude:
+    - app/views/**/*
+    - lib/tasks/**/*

data/lib/rubocop/cop/neeto/direct_liquid_render.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Neeto
+      # `Liquid::Template#render` does not escape its output, so every variable
+      # reaches the page or email as-is. Render Liquid through the shared
+      # renderer, which escapes every output and requires an explicit format.
+      # Code that only checks a template's syntax uses `validate!`, which raises
+      # `Liquid::SyntaxError` like `Liquid::Template.parse` does.
+      #
+      # @example DirectLiquidRender: true (default)
+      #   # bad
+      #   Liquid::Template.parse(template.body).render(variables)
+      #
+      #   # good
+      #   NeetoCommonsBackend::LiquidRenderer.render(template.body, variables, format: :html)
+      #
+      #   # good
+      #   NeetoCommonsBackend::LiquidRenderer.render(template.subject, variables, format: :text)
+      #
+      #   # bad
+      #   Liquid::Template.parse(metadata["body"])
+      #
+      #   # good
+      #   NeetoCommonsBackend::LiquidRenderer.validate!(metadata["body"])
+      #
+      class DirectLiquidRender < Base
+        MSG = "Do not use `Liquid::Template.%<method>s` directly. Render with " \
+              "`NeetoCommonsBackend::LiquidRenderer.render(template, variables, format: :html)`, which escapes " \
+              "every output, or check syntax with `NeetoCommonsBackend::LiquidRenderer.validate!(template)`."
+
+        RESTRICT_ON_SEND = %i[parse new].freeze
+
+        def_node_matcher :liquid_template_build?, <<~PATTERN
+          (send (const (const {nil? cbase} :Liquid) :Template) {:parse :new} ...)
+        PATTERN
+
+        def on_send(node)
+          return unless liquid_template_build?(node)
+
+          add_offense(node, message: format(MSG, method: node.method_name))
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/neeto/html_in_string_literal.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Neeto
+      # Ruby strings never escape what is interpolated into them, so HTML built
+      # in a string or heredoc outside views is one missed escape away from an
+      # injection. Build markup with `tag`, `content_tag`, `link_to`,
+      # `mail_to`, `safe_join` or a partial, which escape their arguments.
+      #
+      # @example HtmlInStringLiteral: true (default)
+      #   # bad
+      #   "<a href='#{url}'>#{name}</a>"
+      #
+      #   # bad
+      #   <<~HTML
+      #     <p>#{description}</p>
+      #   HTML
+      #
+      #   # good
+      #   link_to(name, url)
+      #
+      #   # good
+      #   tag.p(description)
+      #
+      #   # good (searching for markup is not building it)
+      #   body.include?("<table")
+      #
+      class HtmlInStringLiteral < Base
+        MSG = "Do not build HTML in Ruby strings. Use `tag`, `content_tag`, `link_to`, `mail_to`, `safe_join` " \
+              "or a partial, which escape their arguments."
+
+        HTML_TAG = %r{<(?:[a-z][a-z0-9]*[\s/>]|/[a-z][a-z0-9]*\s*>)}i
+        FORMAT_REFERENCE = /%<\w+>/
+
+        ENCLOSING_LITERAL_TYPES = %i[dstr dsym xstr regexp].freeze
+
+        SEARCH_METHODS = %i[
+          include? start_with? end_with? index rindex match match? split scan count delete
+          gsub gsub! sub sub! == != eql?
+        ].freeze
+
+        def on_str(node)
+          return if part_of_another_literal?(node)
+
+          check(node, node.value)
+        end
+
+        def on_dstr(node)
+          return if part_of_another_literal?(node)
+
+          check(node, node.each_child_node(:str).map(&:value).join)
+        end
+
+        private
+
+          def check(node, value)
+            return unless value.valid_encoding? && HTML_TAG.match?(value.gsub(FORMAT_REFERENCE, ""))
+            return if search_argument?(node)
+
+            add_offense(node)
+          end
+
+          def part_of_another_literal?(node)
+            ENCLOSING_LITERAL_TYPES.include?(node.parent&.type)
+          end
+
+          def search_argument?(node)
+            parent = node.parent
+            return false unless parent&.call_type? && SEARCH_METHODS.include?(parent.method_name)
+
+            parent.first_argument.equal?(node) || (parent.comparison_method? && parent.receiver.equal?(node))
+          end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/neeto/html_safe_on_dynamic_string.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Neeto
+      # `html_safe`, `raw` and `safe_concat` mark a string as already safe, so
+      # Rails prints it without escaping. Calling them on a dynamic value
+      # (interpolation, a method result, a variable) turns escaping off for
+      # whatever that value holds, which lets user input inject markup. Build
+      # markup with `tag`, `content_tag`, `link_to`, `mail_to` or `safe_join`
+      # instead. A call that has been reviewed can be kept by adding
+      # `# neeto:html-safe-reviewed <reason>` on or above it.
+      #
+      # @example HtmlSafeOnDynamicString: true (default)
+      #   # bad
+      #   "<b>#{booking.name}</b>".html_safe
+      #
+      #   # bad
+      #   raw(message.body)
+      #
+      #   # good
+      #   tag.b(booking.name)
+      #
+      #   # good
+      #   "<br>".html_safe
+      #
+      #   # good
+      #   # neeto:html-safe-reviewed admin-authored rich text
+      #   meeting.cancellation_policy.html_safe
+      #
+      class HtmlSafeOnDynamicString < Base
+        MSG = "Do not call `%<method>s` on a dynamic value. Build the markup with `tag`, `content_tag`, " \
+              "`link_to`, `mail_to` or `safe_join`, or add `# neeto:html-safe-reviewed <reason>` if the value " \
+              "is known to be safe."
+
+        REVIEWED_ANNOTATION = /#\s*neeto:html-safe-reviewed\s+\S/
+
+        RESTRICT_ON_SEND = %i[html_safe raw safe_concat].freeze
+
+        def on_send(node)
+          value = trusted_value(node)
+          return if value.nil? || static_string?(value) || reviewed?(node)
+
+          add_offense(node.loc.selector, message: format(MSG, method: node.method_name))
+        end
+        alias on_csend on_send
+
+        private
+
+          def trusted_value(node)
+            case node.method_name
+            when :html_safe
+              node.receiver if node.arguments.none?
+            when :raw
+              node.first_argument if node.receiver.nil? && node.arguments.one?
+            when :safe_concat
+              node.first_argument if node.arguments.one?
+            end
+          end
+
+          def static_string?(node)
+            node.str_type? || (node.dstr_type? && node.children.all? { |child| static_string?(child) })
+          end
+
+          def reviewed?(node)
+            lines = (node.first_line - 1)..node.last_line
+
+            processed_source.comments.any? do |comment|
+              lines.cover?(comment.loc.line) && REVIEWED_ANNOTATION.match?(comment.text)
+            end
+          end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/neeto/html_translation_interpolation.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+require "yaml"
+
+module RuboCop
+  module Cop
+    module Neeto
+      # `I18n.t` does not escape interpolated values, even for `_html` keys
+      # (only the view helper `t` does). A translation that contains HTML and
+      # interpolates an unescaped value outside a view lets that value inject
+      # markup. The cop reads the translations from `LocaleFiles`.
+      #
+      # @example HtmlTranslationInterpolation: true (default)
+      #   # en.yml
+      #   #   seed:
+      #   #     description: "<p>Schedule a meeting with %{name}</p>"
+      #
+      #   # bad
+      #   I18n.t("seed.description", name: user.name)
+      #
+      #   # good
+      #   I18n.t("seed.description", name: ERB::Util.html_escape(user.name))
+      #
+      #   # good
+      #   tag.p(I18n.t("seed.description_text", name: user.name))
+      #
+      class HtmlTranslationInterpolation < Base
+        MSG = "Translation `%<key>s` contains HTML and interpolates %<variables>s, which `I18n.t` does not " \
+              "escape. Escape each value with `ERB::Util.html_escape`, or keep the markup out of the translation " \
+              "and build it with `tag` or `content_tag`."
+
+        RESTRICT_ON_SEND = %i[t translate].freeze
+        OPTIONS = %i[locale scope default raise throw count].freeze
+
+        def_node_matcher :translation_call, <<~PATTERN
+          (send {nil? (const {nil? cbase} :I18n)} {:t :translate} (str $_) $...)
+        PATTERN
+
+        def_node_matcher :escaped_value?, <<~PATTERN
+          (send {nil? (const (const {nil? cbase} :ERB) :Util)} {:html_escape :h} _)
+        PATTERN
+
+        def self.translations_cache
+          @_translations_cache ||= {}
+        end
+
+        def on_send(node)
+          translation_call(node) do |key, arguments|
+            options = arguments.last
+            next unless options&.hash_type?
+
+            translation = translations[key]
+            next unless translation.is_a?(String) && HtmlInStringLiteral::HTML_TAG.match?(translation)
+
+            variables = unescaped_variables(options).select { |name| translation.include?("%{#{name}}") }
+            next if variables.empty?
+
+            add_offense(node, message: format(MSG, key:, variables: variables.map { |name| "%{#{name}}" }.join(", ")))
+          end
+        end
+
+        private
+
+          def unescaped_variables(options)
+            options.pairs.filter_map do |pair|
+              next unless pair.key.sym_type?
+              next if OPTIONS.include?(pair.key.value) || escaped_value?(pair.value)
+
+              pair.key.value.to_s
+            end
+          end
+
+          def translations
+            self.class.translations_cache[locale_files] ||= locale_files.each_with_object({}) do |path, result|
+              next unless File.exist?(path)
+
+              YAML.safe_load_file(path, aliases: true)&.each_value { |tree| flatten(tree, nil, result) }
+            end
+          end
+
+          def locale_files
+            Array(cop_config["LocaleFiles"]).map { |path| File.expand_path(path, config.base_dir_for_path_parameters) }
+          end
+
+          def flatten(tree, prefix, result)
+            return result[prefix] = tree unless tree.is_a?(Hash)
+
+            tree.each { |key, value| flatten(value, [prefix, key].compact.join("."), result) }
+          end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/neeto_cops.rb

@@ -5,3 +5,7 @@ require_relative "neeto/unsafe_column_deletion"
 require_relative "neeto/direct_env_access"
 require_relative "neeto/deprecated_job_base_class"
 require_relative "neeto/faraday_over_httparty"
+require_relative "neeto/html_safe_on_dynamic_string"
+require_relative "neeto/html_in_string_literal"
+require_relative "neeto/direct_liquid_render"
+require_relative "neeto/html_translation_interpolation"

data/lib/rubocop/neeto/version.rb

@@ -2,6 +2,6 @@
 
 module RuboCop
   module Neeto
-    VERSION = "0.1.19"
+    VERSION = "0.1.20"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rubocop-neeto
 version: !ruby/object:Gem::Version
-  version: 0.1.19
+  version: 0.1.20
 platform: ruby
 authors:
-- Yedhin Kizhakkethara
+- Neeraj Singh
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-06-02 00:00:00.000000000 Z
+date: 2026-10-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rubocop
@@ -26,7 +26,7 @@ dependencies:
         version: '0'
 description:
 email:
-- yedhin@bigbinary.com
+- neeraj@neeto.com
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -37,7 +37,11 @@ files:
 - lib/rubocop-neeto.rb
 - lib/rubocop/cop/neeto/deprecated_job_base_class.rb
 - lib/rubocop/cop/neeto/direct_env_access.rb
+- lib/rubocop/cop/neeto/direct_liquid_render.rb
 - lib/rubocop/cop/neeto/faraday_over_httparty.rb
+- lib/rubocop/cop/neeto/html_in_string_literal.rb
+- lib/rubocop/cop/neeto/html_safe_on_dynamic_string.rb
+- lib/rubocop/cop/neeto/html_translation_interpolation.rb
 - lib/rubocop/cop/neeto/unsafe_column_deletion.rb
 - lib/rubocop/cop/neeto/unsafe_table_deletion.rb
 - lib/rubocop/cop/neeto_cops.rb