rubocop-neeto 0.1.19 → 0.1.21

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a114d1fda0a6640c867ce32d0882d0c804d1e0b4f273d9bfcf13f35d77e8cda7
-  data.tar.gz: 0f27ddfd9cfce7a6e6499716441730003bf5f4657b650020866ba811bc7966ac
+  metadata.gz: 8f79480fcc020ba036f101838a8970627d0d6cee99fdf7db819c0eaf55430e8f
+  data.tar.gz: 510ea55903e4e085be783f0bfc618e5e28f725ac399c83d992ea03473b030dff
 SHA512:
-  metadata.gz: 8c02805a3712d669826caa86ec47a886347bc3657e8d1d72901f3f5465babcdd9c666e76e63374b3e6ac17c52f0511fe65b2bfb4be4bc1f0eb97ea800fef6f19
-  data.tar.gz: 726009349f00e1615c5b6e4752bc4cd5be629e3b142af7fb6b3f3bd2d801203a172b70c48a05b4f252063802db1ca001526d0c54a727b676d77177ddca2b29ae
+  metadata.gz: 8e93ef6aac8079e2a95f8994e63d34f826a3f5f56041d7285695323bcb3a1910c16027c6a1278c2a81c15d52454366f7a65e89619a14ef7c2592afcdbb499344
+  data.tar.gz: 266c32b005d5d7bfb3933f936dc27895e0d388db5e74dfbc4bcf52cfe3683ef58158c8a1f6240d5a7dbf680bd2631eea6fdac5ea949690de839c68a342295ef0

data/README.md

@@ -7,6 +7,12 @@
 3. [Neeto/DirectEnvAccess](https://rubocop-neeto.neetodeployapp.com/docs/RuboCop/Cop/Neeto/DirectEnvAccess)
 4. [Neeto/DeprecatedJobBaseClass](https://rubocop-neeto.neetodeployapp.com/docs/RuboCop/Cop/Neeto/DeprecatedJobBaseClass)
 5. [Neeto/FaradayOverHttparty](https://rubocop-neeto.neetodeployapp.com/docs/RuboCop/Cop/Neeto/FaradayOverHttparty)
+6. [Neeto/HtmlSafeOnDynamicString](https://rubocop-neeto.neetodeployapp.com/docs/RuboCop/Cop/Neeto/HtmlSafeOnDynamicString)
+7. [Neeto/HtmlInStringLiteral](https://rubocop-neeto.neetodeployapp.com/docs/RuboCop/Cop/Neeto/HtmlInStringLiteral)
+8. [Neeto/DirectLiquidRender](https://rubocop-neeto.neetodeployapp.com/docs/RuboCop/Cop/Neeto/DirectLiquidRender)
+9. [Neeto/HtmlTranslationInterpolation](https://rubocop-neeto.neetodeployapp.com/docs/RuboCop/Cop/Neeto/HtmlTranslationInterpolation)
+
+The HTML-safety cops (6 to 9) report at `Severity: refactor`, like the other Neeto cops, so their offenses fail RuboCop and erb_lint at the default fail level.
 
 ## Installation
 

data/config/default.yml

@@ -64,3 +64,69 @@ Neeto/FaradayOverHttparty:
   Include:
     - '**/Gemfile'
     - '**/Gemfile.common.rb'
+
+Neeto/HtmlSafeOnDynamicString:
+  Description: >-
+    `html_safe`, `raw` and `safe_concat` mark a string as already safe, so
+    Rails emits it without escaping. Calling them on dynamic values
+    (interpolation, method results, variables) turns off output escaping for
+    that value. Build markup with `tag`, `content_tag`, `link_to`, `mail_to`
+    or `safe_join` instead, or annotate a reviewed call with
+    `# neeto:html-safe-reviewed <reason>`.
+  Enabled: true
+  Severity: refactor
+  VersionAdded: '0.1'
+  Include:
+    - app/**/*.rb
+    - lib/**/*.rb
+    - app/views/**/*.erb
+    - app/views/**/*.inky
+
+Neeto/HtmlInStringLiteral:
+  Description: >-
+    Plain Ruby strings never escape what is interpolated into them. Build
+    markup outside views with `tag`, `content_tag`, `link_to`, `mail_to`,
+    `safe_join` or a partial instead of string literals and heredocs.
+  Enabled: true
+  Severity: refactor
+  VersionAdded: '0.1'
+  Include:
+    - app/**/*.rb
+    - lib/**/*.rb
+  Exclude:
+    - app/views/**/*
+    - lib/tasks/**/*
+
+Neeto/DirectLiquidRender:
+  Description: >-
+    `Liquid::Template#render` does not escape its output. Build and render
+    Liquid templates only through `NeetoCommonsBackend::LiquidRenderer`, which
+    escapes every output and requires an explicit format (`:html` or `:text`).
+    Check a template's syntax with `NeetoCommonsBackend::LiquidRenderer.validate!`.
+  Enabled: true
+  Severity: refactor
+  VersionAdded: '0.1'
+  Include:
+    - app/**/*.rb
+    - lib/**/*.rb
+    - app/**/*.jbuilder
+
+Neeto/HtmlTranslationInterpolation:
+  Description: >-
+    `I18n.t` does not escape interpolated values, even for `_html` keys. A
+    translation that contains HTML must not interpolate unescaped values.
+    Escape each value with `ERB::Util.html_escape`, or keep the markup out of
+    the translation and build it with `tag` or `content_tag`.
+  Enabled: true
+  Severity: refactor
+  VersionAdded: '0.1'
+  LocaleFiles:
+    - config/locales/**/en.yml
+    - config/locales/**/*.en.yml
+  Include:
+    - app/**/*.rb
+    - lib/**/*.rb
+    - app/views/**/*.erb
+    - app/views/**/*.inky
+  Exclude:
+    - lib/tasks/**/*

data/lib/rubocop/cop/neeto/direct_liquid_render.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Neeto
+      # `Liquid::Template#render` does not escape its output, so every variable
+      # reaches the page or email as-is. Render Liquid through the shared
+      # renderer, which escapes every output and requires an explicit format.
+      # Code that only checks a template's syntax uses `validate!`, which raises
+      # `Liquid::SyntaxError` like `Liquid::Template.parse` does.
+      #
+      # @example DirectLiquidRender: true (default)
+      #   # bad
+      #   Liquid::Template.parse(template.body).render(variables)
+      #
+      #   # good
+      #   NeetoCommonsBackend::LiquidRenderer.render(template.body, variables, format: :html)
+      #
+      #   # good
+      #   NeetoCommonsBackend::LiquidRenderer.render(template.subject, variables, format: :text)
+      #
+      #   # bad
+      #   Liquid::Template.parse(metadata["body"])
+      #
+      #   # good
+      #   NeetoCommonsBackend::LiquidRenderer.validate!(metadata["body"])
+      #
+      class DirectLiquidRender < Base
+        MSG = "Do not use `Liquid::Template.%<method>s` directly. Render with " \
+              "`NeetoCommonsBackend::LiquidRenderer.render(template, variables, format: :html)`, which escapes " \
+              "every output, or check syntax with `NeetoCommonsBackend::LiquidRenderer.validate!(template)`."
+
+        RESTRICT_ON_SEND = %i[parse new].freeze
+
+        def_node_matcher :liquid_template_build?, <<~PATTERN
+          (send (const (const {nil? cbase} :Liquid) :Template) {:parse :new} ...)
+        PATTERN
+
+        def on_send(node)
+          return unless liquid_template_build?(node)
+
+          add_offense(node, message: format(MSG, method: node.method_name))
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/neeto/html_in_string_literal.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Neeto
+      # Ruby strings never escape what is interpolated into them, so HTML built
+      # in a string or heredoc outside views is one missed escape away from an
+      # injection. Build markup with `tag`, `content_tag`, `link_to`,
+      # `mail_to`, `safe_join` or a partial, which escape their arguments.
+      #
+      # @example HtmlInStringLiteral: true (default)
+      #   # bad
+      #   "<a href='#{url}'>#{name}</a>"
+      #
+      #   # bad
+      #   <<~HTML
+      #     <p>#{description}</p>
+      #   HTML
+      #
+      #   # good
+      #   link_to(name, url)
+      #
+      #   # good
+      #   tag.p(description)
+      #
+      #   # good (searching for markup is not building it)
+      #   body.include?("<table")
+      #
+      class HtmlInStringLiteral < Base
+        MSG = "Do not build HTML in Ruby strings. Use `tag`, `content_tag`, `link_to`, `mail_to`, `safe_join` " \
+              "or a partial, which escape their arguments."
+
+        HTML_TAG = %r{<(?:[a-z][a-z0-9]*[\s/>]|/[a-z][a-z0-9]*\s*>)}i
+        FORMAT_REFERENCE = /%<\w+>/
+
+        ENCLOSING_LITERAL_TYPES = %i[dstr dsym xstr regexp].freeze
+
+        SEARCH_METHODS = %i[
+          include? start_with? end_with? index rindex match match? split scan count delete
+          gsub gsub! sub sub! == != eql?
+        ].freeze
+
+        def on_str(node)
+          return if part_of_another_literal?(node)
+
+          check(node, node.value)
+        end
+
+        def on_dstr(node)
+          return if part_of_another_literal?(node)
+
+          check(node, literal_text(node))
+        end
+
+        private
+
+          def check(node, value)
+            return unless value.valid_encoding? && HTML_TAG.match?(value.gsub(FORMAT_REFERENCE, ""))
+            return if search_argument?(node)
+
+            add_offense(node)
+          end
+
+          def literal_text(node)
+            node.each_child_node(:str, :dstr).map { |child| child.str_type? ? child.value : literal_text(child) }.join
+          end
+
+          def part_of_another_literal?(node)
+            ENCLOSING_LITERAL_TYPES.include?(node.parent&.type)
+          end
+
+          def search_argument?(node)
+            parent = node.parent
+            return false unless parent&.call_type? && SEARCH_METHODS.include?(parent.method_name)
+
+            parent.first_argument.equal?(node) || (parent.comparison_method? && parent.receiver.equal?(node))
+          end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/neeto/html_safe_on_dynamic_string.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Neeto
+      # `html_safe`, `raw` and `safe_concat` mark a string as already safe, so
+      # Rails prints it without escaping. Calling them on a dynamic value
+      # (interpolation, a method result, a variable) turns escaping off for
+      # whatever that value holds, which lets user input inject markup. Build
+      # markup with `tag`, `content_tag`, `link_to`, `mail_to` or `safe_join`
+      # instead. A call that has been reviewed can be kept by adding
+      # `# neeto:html-safe-reviewed <reason>` on or above it.
+      #
+      # @example HtmlSafeOnDynamicString: true (default)
+      #   # bad
+      #   "<b>#{booking.name}</b>".html_safe
+      #
+      #   # bad
+      #   raw(message.body)
+      #
+      #   # good
+      #   tag.b(booking.name)
+      #
+      #   # good
+      #   "<br>".html_safe
+      #
+      #   # good
+      #   # neeto:html-safe-reviewed admin-authored rich text
+      #   meeting.cancellation_policy.html_safe
+      #
+      class HtmlSafeOnDynamicString < Base
+        MSG = "Do not call `%<method>s` on a dynamic value. Build the markup with `tag`, `content_tag`, " \
+              "`link_to`, `mail_to` or `safe_join`, or add `# neeto:html-safe-reviewed <reason>` if the value " \
+              "is known to be safe."
+
+        REVIEWED_ANNOTATION = /#\s*neeto:html-safe-reviewed\s+\S/
+
+        RESTRICT_ON_SEND = %i[html_safe raw safe_concat].freeze
+
+        def_node_matcher :view_helpers?, <<~PATTERN
+          (send _ {:helpers :view_context})
+        PATTERN
+
+        def on_send(node)
+          value = trusted_value(node)
+          return if value.nil? || static_string?(value) || reviewed?(node)
+
+          add_offense(node.loc.selector, message: format(MSG, method: node.method_name))
+        end
+        alias on_csend on_send
+
+        private
+
+          def trusted_value(node)
+            case node.method_name
+            when :html_safe
+              node.receiver if node.arguments.none?
+            when :raw
+              node.first_argument if (node.receiver.nil? || view_helpers?(node.receiver)) && node.arguments.one?
+            when :safe_concat
+              node.first_argument if node.arguments.one?
+            end
+          end
+
+          def static_string?(node)
+            node.str_type? || (node.dstr_type? && node.children.all? { |child| static_string?(child) })
+          end
+
+          def reviewed?(node)
+            lines = (node.first_line - 1)..node.last_line
+
+            processed_source.comments.any? do |comment|
+              lines.cover?(comment.loc.line) && REVIEWED_ANNOTATION.match?(comment.text)
+            end
+          end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/neeto/html_translation_interpolation.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+require "yaml"
+
+module RuboCop
+  module Cop
+    module Neeto
+      # `I18n.t` does not escape interpolated values, even for `_html` keys
+      # (only the view helper `t` does). A translation that contains HTML and
+      # interpolates an unescaped value lets that value inject markup. In views,
+      # the `t` helper escapes the values of `_html` keys, so only those are
+      # allowed there. The cop reads the translations from `LocaleFiles`.
+      #
+      # @example HtmlTranslationInterpolation: true (default)
+      #   # en.yml
+      #   #   seed:
+      #   #     description: "<p>Schedule a meeting with %{name}</p>"
+      #
+      #   # bad
+      #   I18n.t("seed.description", name: user.name)
+      #
+      #   # good
+      #   I18n.t("seed.description", name: ERB::Util.html_escape(user.name))
+      #
+      #   # good
+      #   tag.p(I18n.t("seed.description_text", name: user.name))
+      #
+      #   # bad (in a view)
+      #   <%= sanitize t("seed.description", name: @name) %>
+      #
+      #   # good (in a view)
+      #   <%= t("seed.description_html", name: @name) %>
+      #
+      class HtmlTranslationInterpolation < Base
+        MSG = "Translation `%<key>s` contains HTML and interpolates %<variables>s, which `I18n.t` does not " \
+              "escape. Escape each value with `ERB::Util.html_escape`, or keep the markup out of the translation " \
+              "and build it with `tag` or `content_tag`."
+
+        RESTRICT_ON_SEND = %i[t translate].freeze
+        OPTIONS = %i[locale scope default raise throw count].freeze
+        VIEW_FILE = %r{(?:\A|/)app/views/}
+
+        def_node_matcher :translation_call, <<~PATTERN
+          (send {nil? (const {nil? cbase} :I18n)} {:t :translate} ${str sym array} $...)
+        PATTERN
+
+        def_node_matcher :escaped_value?, <<~PATTERN
+          {
+            (send {nil? (const (const {nil? cbase} :ERB) :Util)} {:html_escape :h} _)
+            (send (const {nil? cbase} :CGI) :escapeHTML _)
+            (send _ {:link_to :content_tag :mail_to :safe_join} ...)
+            (send (send _ :tag) _ ...)
+          }
+        PATTERN
+
+        def self.translations_cache
+          @_translations_cache ||= {}
+        end
+
+        def on_send(node)
+          translation_call(node) do |key_node, arguments|
+            options = arguments.last
+            next unless options&.hash_type?
+
+            key = translation_key(key_node, options)
+            next if key.nil? || escaped_by_view_helper?(node, key)
+
+            translation = translations[key]
+            next unless translation.is_a?(String) && HtmlInStringLiteral::HTML_TAG.match?(translation)
+
+            variables = unescaped_variables(options).select { |name| translation.include?("%{#{name}}") }
+            next if variables.empty?
+
+            add_offense(node, message: format(MSG, key:, variables: variables.map { |name| "%{#{name}}" }.join(", ")))
+          end
+        end
+
+        private
+
+          def escaped_by_view_helper?(node, key)
+            node.receiver.nil? && VIEW_FILE.match?(processed_source.file_path.to_s) &&
+              (key.end_with?("_html") || key.split(".").last == "html")
+          end
+
+          def translation_key(key_node, options)
+            key = literal_path(key_node)
+            scope = options.pairs.find { |pair| pair.key.sym_type? && pair.key.value == :scope }&.value
+            return key if scope.nil? || key.nil?
+
+            scope_path = literal_path(scope)
+            "#{scope_path}.#{key}" if scope_path
+          end
+
+          def literal_path(node)
+            parts = node.array_type? ? node.values : [node]
+            return unless parts.all? { |part| %i[str sym].include?(part.type) }
+
+            parts.map { |part| part.value.to_s }.join(".")
+          end
+
+          def unescaped_variables(options)
+            options.pairs.filter_map do |pair|
+              next unless pair.key.sym_type?
+              next if OPTIONS.include?(pair.key.value) || escaped_value?(pair.value)
+
+              pair.key.value.to_s
+            end
+          end
+
+          def translations
+            self.class.translations_cache[locale_files] ||= locale_files.each_with_object({}) do |path, result|
+              YAML.safe_load_file(path, aliases: true)&.each_value { |tree| flatten(tree, nil, result) }
+            end
+          end
+
+          def locale_files
+            Array(cop_config["LocaleFiles"]).flat_map do |pattern|
+              Dir.glob(File.expand_path(pattern, config.base_dir_for_path_parameters))
+            end.sort
+          end
+
+          def flatten(tree, prefix, result)
+            return result[prefix] = tree unless tree.is_a?(Hash)
+
+            tree.each { |key, value| flatten(value, [prefix, key].compact.join("."), result) }
+          end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/neeto_cops.rb

@@ -5,3 +5,7 @@ require_relative "neeto/unsafe_column_deletion"
 require_relative "neeto/direct_env_access"
 require_relative "neeto/deprecated_job_base_class"
 require_relative "neeto/faraday_over_httparty"
+require_relative "neeto/html_safe_on_dynamic_string"
+require_relative "neeto/html_in_string_literal"
+require_relative "neeto/direct_liquid_render"
+require_relative "neeto/html_translation_interpolation"

data/lib/rubocop/neeto/version.rb

@@ -2,6 +2,6 @@
 
 module RuboCop
   module Neeto
-    VERSION = "0.1.19"
+    VERSION = "0.1.21"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rubocop-neeto
 version: !ruby/object:Gem::Version
-  version: 0.1.19
+  version: 0.1.21
 platform: ruby
 authors:
-- Yedhin Kizhakkethara
+- Neeraj Singh
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-06-02 00:00:00.000000000 Z
+date: 2026-11-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rubocop
@@ -26,7 +26,7 @@ dependencies:
         version: '0'
 description:
 email:
-- yedhin@bigbinary.com
+- neeraj@neeto.com
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -37,7 +37,11 @@ files:
 - lib/rubocop-neeto.rb
 - lib/rubocop/cop/neeto/deprecated_job_base_class.rb
 - lib/rubocop/cop/neeto/direct_env_access.rb
+- lib/rubocop/cop/neeto/direct_liquid_render.rb
 - lib/rubocop/cop/neeto/faraday_over_httparty.rb
+- lib/rubocop/cop/neeto/html_in_string_literal.rb
+- lib/rubocop/cop/neeto/html_safe_on_dynamic_string.rb
+- lib/rubocop/cop/neeto/html_translation_interpolation.rb
 - lib/rubocop/cop/neeto/unsafe_column_deletion.rb
 - lib/rubocop/cop/neeto/unsafe_table_deletion.rb
 - lib/rubocop/cop/neeto_cops.rb