rubocop-thread_safety 0.4.4 → 0.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9f779f952ad93ee231e590b53de736e1aa6f8bfc421032e1093e495a6a1b58d5
-  data.tar.gz: 31afd6b2f36af51336751d2de2b31b794c61e64bd8363c71bde8750df1e0b728
+  metadata.gz: cdf9af170c6dcfe7ac085b6e68467551d4c14d1eac843fefb97f39645cf556a6
+  data.tar.gz: e6efe781ead225cbdcf14185a67851a57fa60fe0e31627342a7204eb5f656c3f
 SHA512:
-  metadata.gz: 71ac5c818dce793fdf24c6cb7e3f486bf8e897e9a9f8066bdf8b2cd25ac6637060cf65314b25fa2d7f4450dccf55e0eb4310679d32a2488aeef545effa6b0c06
-  data.tar.gz: 3c90b593c9f948b1c75eec96edafeb14cb83934eae67e49fc032098cba86855fe5b39178c1f44376a6da05db994b8b8560bc0d4b48bf76239f3b6411474d5a24
+  metadata.gz: 18e2788dfc505506dd73e7231008200edca8c5055612442b14e6639ff362af00e4de983fc4be0980e6f3820a365175138cd7d04708ced0bf401db3c00eb429df
+  data.tar.gz: 94da6513c5ed7f1561f7e88385b3eddb6da8984127ac1da7e16f0a4c6c4c871390af0599b7b8c43c53bfc792af82363fdbe16b848fc7a93c6a10ea6d630e60d4

data/CHANGELOG.md

@@ -0,0 +1,30 @@
+# Change log
+
+## master
+
+## 0.7.2
+
+- [#88](https://github.com/rubocop/rubocop-thread_safety/pull/88): Fix incorrect plugin metadata version. ([@viralpraxis](https://github.com/viralpraxis))
+
+## 0.7.1
+
+- [#84](https://github.com/rubocop/rubocop-thread_safety/pull/84): Rename `InstanceVariableInClassMethod` in default config ([@sambostock](https://github.com/sambostock))
+
+## 0.7.0
+
+- [#80](https://github.com/rubocop/rubocop-thread_safety/pull/80) Make RuboCop ThreadSafety work as a RuboCop plugin. ([@bquorning](https://github.com/bquorning))
+- [#76](https://github.com/rubocop/rubocop-thread_safety/pull/76): Detect offenses when using safe navigation for `ThreadSafety/DirChdir`, `ThreadSafety/NewThread` and `ThreadSafety/RackMiddlewareInstanceVariable` cops. ([@viralpraxis](https://github.com/viralpraxis))
+- [#73](https://github.com/rubocop/rubocop-thread_safety/pull/73): Add `AllowCallWithBlock` option to `ThreadSafety/DirChdir` cop. ([@viralpraxis](https://github.com/viralpraxis))
+
+## 0.6.0
+
+* [#59](https://github.com/rubocop/rubocop-thread_safety/pull/59): Rename `ThreadSafety::InstanceVariableInClassMethod` cop to `ThreadSafety::ClassInstanceVariable` to better reflect its purpose. ([@viralpraxis](https://github.com/viralpraxis))
+* [#55](https://github.com/rubocop/rubocop-thread_safety/pull/55): Enhance `ThreadSafety::InstanceVariableInClassMethod` cop to detect offenses within `class_eval/exec` blocks. ([@viralpraxis](https://github.com/viralpraxis))
+* [#54](https://github.com/rubocop/rubocop-thread_safety/pull/54): Drop support for RuboCop older than 1.48. ([@viralpraxis](https://github.com/viralpraxis))
+* [#52](https://github.com/rubocop/rubocop-thread_safety/pull/52): Add new `RackMiddlewareInstanceVariable` cop to detect instance variables in Rack middleware. ([@viralpraxis](https://github.com/viralpraxis))
+* [#48](https://github.com/rubocop/rubocop-thread_safety/pull/48): Do not report instance variables in `ActionDispatch` callbacks in singleton methods. ([@viralpraxis](https://github.com/viralpraxis))
+* [#43](https://github.com/rubocop/rubocop-thread_safety/pull/43): Make detection of ActiveSupport's `class_attribute` configurable. ([@viralpraxis](https://github.com/viralpraxis))
+* [#42](https://github.com/rubocop/rubocop-thread_safety/pull/42): Fix some `InstanceVariableInClassMethod` cop false positive offenses. ([@viralpraxis](https://github.com/viralpraxis))
+* [#41](https://github.com/rubocop/rubocop-thread_safety/pull/41): Drop support for MRI older than 2.7. ([@viralpraxis](https://github.com/viralpraxis))
+* [#38](https://github.com/rubocop/rubocop-thread_safety/pull/38): Fix `NewThread` cop detection is case of `Thread.start`, `Thread.fork`, or `Thread.new` with arguments. ([@viralpraxis](https://github.com/viralpraxis))
+* [#36](https://github.com/rubocop/rubocop-thread_safety/pull/36): Add new `DirChdir` cop to detect `Dir.chdir` calls. ([@viralpraxis](https://github.com/viralpraxis))

data/LICENSE.txt

@@ -1,4 +1,5 @@
-Copyright 2016-2021 CoverMyMeds
+Portions Copyright 2016-2023 Michael Gee and contributors
+Portions Copyright 2016-2022 CoverMyMeds
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 

data/README.md

@@ -1,16 +1,16 @@
 # RuboCop::ThreadSafety
 
 Thread-safety analysis for your projects, as an extension to
-[RuboCop](https://github.com/bbatsov/rubocop).
+[RuboCop](https://github.com/rubocop/rubocop).
 
 ## Installation and Usage
 
 ### Installation into an application
 
-Add this line to your application's Gemfile:
+Add this line to your application's Gemfile (using `require: false` as it's a standalone tool):
 
 ```ruby
-gem 'rubocop-thread_safety'
+gem 'rubocop-thread_safety', require: false
 ```
 
 Install it with Bundler by invoking:
@@ -19,11 +19,14 @@ Install it with Bundler by invoking:
 
 Add this line to your application's `.rubocop.yml`:
 
-    require: rubocop-thread_safety
+    plugins: rubocop-thread_safety
 
 Now you can run `rubocop` and it will automatically load the RuboCop
 Thread-Safety cops together with the standard cops.
 
+> [!NOTE]
+> The plugin system is supported in RuboCop 1.72+. In earlier versions, use `require` instead of `plugins`.
+
 ### Scanning an application without adding it to the Gemfile
 
 Install the gem:
@@ -32,11 +35,11 @@ Install the gem:
 
 Scan the application for just thread-safety issues:
 
-    $ rubocop -r rubocop-thread_safety --only ThreadSafety,Style/GlobalVars,Style/ClassVars,Style/MutableConstant
+    $ rubocop --plugin rubocop-thread_safety --only ThreadSafety,Style/GlobalVars,Style/ClassVars,Style/MutableConstant
 
 ### Configuration
 
-There are some added [configuration options](https://github.com/covermymeds/rubocop-thread_safety/blob/master/config/default.yml) that can be tweaked to modify the behaviour of these thread-safety cops.
+There are some added [configuration options](https://github.com/rubocop/rubocop-thread_safety/blob/master/config/default.yml) that can be tweaked to modify the behaviour of these thread-safety cops.
 
 ### Correcting code for thread-safety
 
@@ -60,6 +63,8 @@ Improvements that would make shared state thread-safe include:
 * Use [`RequestStore`](https://github.com/steveklabnik/request_store)
 * Use `Thread.current[:name]`
 
+Certain system calls, such as `chdir`, affect the entire process. To avoid potential thread-safety issues, it's preferable to use (if possible) the `chdir` option in methods like `Kernel.system` and `IO.popen` rather than relying on `Dir.chdir`.
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
@@ -68,9 +73,11 @@ To install this gem onto your local machine, run `bundle exec rake install`. To
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/covermymeds/rubocop-thread_safety.
+Bug reports and pull requests are welcome on GitHub at https://github.com/rubocop/rubocop-thread_safety.
 
 ## Copyright
 
-Copyright (c) 2016-2021 CoverMyMeds.
+Portions Copyright (c) 2016-2023 Michael Gee and [contributors](https://github.com/rubocop/rubocop-thread_safety/graphs/contributors).
+Portions Copyright (c) 2016-2023 CoverMyMeds.
+
 See [LICENSE.txt](LICENSE.txt) for further details.

data/config/default.yml

@@ -5,15 +5,17 @@
 ThreadSafety/ClassAndModuleAttributes:
   Description: 'Avoid mutating class and module attributes.'
   Enabled: true
+  ActiveSupportClassAttributeAllowed: false
 
-ThreadSafety/InstanceVariableInClassMethod:
-  Description: 'Avoid using instance variables in class methods.'
+ThreadSafety/ClassInstanceVariable:
+  Description: 'Avoid class instance variables.'
   Enabled: true
 
 ThreadSafety/MutableClassInstanceVariable:
   Description: 'Do not assign mutable objects to class instance variables.'
   Enabled: true
   EnforcedStyle: literals
+  SafeAutoCorrect: false
   SupportedStyles:
     # literals: freeze literals assigned to constants
     # strict: freeze all constants
@@ -29,3 +31,18 @@ ThreadSafety/NewThread:
                  Avoid starting new threads.
                  Let a framework like Sidekiq handle the threads.
   Enabled: true
+
+ThreadSafety/DirChdir:
+  Description: Avoid using `Dir.chdir` due to its process-wide effect.
+  Enabled: true
+  AllowCallWithBlock: false
+
+ThreadSafety/RackMiddlewareInstanceVariable:
+  Description: Avoid instance variables in Rack middleware.
+  Enabled: true
+  Include:
+    - 'app/middleware/**/*.rb'
+    - 'lib/middleware/**/*.rb'
+    - 'app/middlewares/**/*.rb'
+    - 'lib/middlewares/**/*.rb'
+  AllowedIdentifiers: []

data/config/obsoletion.yml

@@ -0,0 +1,2 @@
+renamed:
+  ThreadSafety/InstanceVariableInClassMethod: ThreadSafety/ClassInstanceVariable

data/lib/rubocop/cop/mixin/operation_with_threadsafe_result.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    # Common functionality for checking if a well-known operation
+    # produces an object with thread-safe semantics.
+    module OperationWithThreadsafeResult
+      extend NodePattern::Macros
+
+      # @!method operation_produces_threadsafe_object?(node)
+      def_node_matcher :operation_produces_threadsafe_object?, <<~PATTERN
+        {
+          (send (const {nil? cbase} :Queue) :new ...)
+          (send
+            (const (const {nil? cbase} :ThreadSafe) {:Hash :Array})
+            :new ...)
+          (block
+            (send
+              (const (const {nil? cbase} :ThreadSafe) {:Hash :Array})
+              :new ...)
+            ...)
+          (send (const (const {nil? cbase} :Concurrent) _) :new ...)
+          (block
+            (send (const (const {nil? cbase} :Concurrent) _) :new ...)
+            ...)
+          (send (const (const (const {nil? cbase} :Concurrent) _) _) :new ...)
+          (block
+            (send
+              (const (const (const {nil? cbase} :Concurrent) _) _)
+              :new ...)
+            ...)
+          (send
+            (const (const (const (const {nil? cbase} :Concurrent) _) _) _)
+            :new ...)
+          (block
+            (send
+              (const (const (const (const {nil? cbase} :Concurrent) _) _) _)
+              :new ...)
+            ...)
+        }
+      PATTERN
+    end
+  end
+end

data/lib/rubocop/cop/thread_safety/class_and_module_attributes.rb

@@ -12,38 +12,47 @@ module RuboCop
       #   class User
       #     cattr_accessor :current_user
       #   end
-      class ClassAndModuleAttributes < Cop
+      class ClassAndModuleAttributes < Base
         MSG = 'Avoid mutating class and module attributes.'
+        RESTRICT_ON_SEND = %i[
+          mattr_writer mattr_accessor cattr_writer cattr_accessor
+          class_attribute
+          attr attr_accessor attr_writer
+          attr_internal attr_internal_accessor attr_internal_writer
+        ].freeze
 
+        # @!method mattr?(node)
         def_node_matcher :mattr?, <<~MATCHER
           (send nil?
             {:mattr_writer :mattr_accessor :cattr_writer :cattr_accessor}
             ...)
         MATCHER
 
+        # @!method attr?(node)
         def_node_matcher :attr?, <<~MATCHER
           (send nil?
             {:attr :attr_accessor :attr_writer}
             ...)
         MATCHER
 
+        # @!method attr_internal?(node)
         def_node_matcher :attr_internal?, <<~MATCHER
           (send nil?
             {:attr_internal :attr_internal_accessor :attr_internal_writer}
             ...)
         MATCHER
 
+        # @!method class_attr?(node)
         def_node_matcher :class_attr?, <<~MATCHER
           (send nil?
             :class_attribute
             ...)
         MATCHER
 
-        def on_send(node)
-          return unless mattr?(node) || class_attr?(node) ||
-                        singleton_attr?(node)
+        def on_send(node) # rubocop:disable InternalAffairs/OnSendWithoutOnCSend
+          return unless mattr?(node) || (!class_attribute_allowed? && class_attr?(node)) || singleton_attr?(node)
 
-          add_offense(node, message: MSG)
+          add_offense(node)
         end
 
         private
@@ -64,6 +73,10 @@ module RuboCop
 
           false
         end
+
+        def class_attribute_allowed?
+          cop_config['ActiveSupportClassAttributeAllowed']
+        end
       end
     end
   end

data/lib/rubocop/cop/thread_safety/class_instance_variable.rb

@@ -0,0 +1,259 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module ThreadSafety
+      # Avoid class instance variables.
+      #
+      # @example
+      #   # bad
+      #   class User
+      #     def self.notify(info)
+      #       @info = validate(info)
+      #       Notifier.new(@info).deliver
+      #     end
+      #   end
+      #
+      #   class Model
+      #     class << self
+      #       def table_name(name)
+      #         @table_name = name
+      #       end
+      #     end
+      #   end
+      #
+      #   class Host
+      #     %i[uri port].each do |key|
+      #       define_singleton_method("#{key}=") do |value|
+      #         instance_variable_set("@#{key}", value)
+      #       end
+      #     end
+      #   end
+      #
+      #   module Example
+      #     module ClassMethods
+      #       def test(params)
+      #         @params = params
+      #       end
+      #     end
+      #   end
+      #
+      #   module Example
+      #     class_methods do
+      #       def test(params)
+      #         @params = params
+      #       end
+      #     end
+      #   end
+      #
+      #   module Example
+      #     module_function
+      #
+      #     def test(params)
+      #       @params = params
+      #     end
+      #   end
+      #
+      #   module Example
+      #     def test(params)
+      #       @params = params
+      #     end
+      #
+      #     module_function :test
+      #   end
+      class ClassInstanceVariable < Base
+        MSG = 'Avoid class instance variables.'
+        RESTRICT_ON_SEND = %i[
+          instance_variable_set
+          instance_variable_get
+        ].freeze
+
+        # @!method instance_variable_set_call?(node)
+        def_node_matcher :instance_variable_set_call?, <<~MATCHER
+          (send nil? :instance_variable_set (...) (...))
+        MATCHER
+
+        # @!method instance_variable_get_call?(node)
+        def_node_matcher :instance_variable_get_call?, <<~MATCHER
+          (send nil? :instance_variable_get (...))
+        MATCHER
+
+        def on_ivar(node)
+          return unless class_method_definition?(node)
+          return if method_definition?(node)
+          return if synchronized?(node)
+
+          add_offense(node.loc.name)
+        end
+        alias on_ivasgn on_ivar
+
+        def on_send(node) # rubocop:disable InternalAffairs/OnSendWithoutOnCSend
+          return unless instance_variable_call?(node)
+          return unless class_method_definition?(node)
+          return if method_definition?(node)
+          return if synchronized?(node)
+
+          add_offense(node)
+        end
+
+        private
+
+        def class_method_definition?(node)
+          in_defs?(node) ||
+            in_def_sclass?(node) ||
+            in_def_class_methods?(node) ||
+            in_def_module_function?(node) ||
+            in_class_eval?(node) ||
+            singleton_method_definition?(node)
+        end
+
+        def in_defs?(node)
+          node.ancestors.any? do |ancestor|
+            break false if new_lexical_scope?(ancestor)
+
+            ancestor.defs_type?
+          end
+        end
+
+        def in_def_sclass?(node)
+          defn = node.ancestors.find do |ancestor|
+            break if new_lexical_scope?(ancestor)
+
+            ancestor.def_type?
+          end
+
+          defn&.ancestors&.any?(&:sclass_type?)
+        end
+
+        def in_def_class_methods?(node)
+          in_def_class_methods_dsl?(node) || in_def_class_methods_module?(node)
+        end
+
+        def in_def_class_methods_dsl?(node)
+          node.ancestors.any? do |ancestor|
+            break if new_lexical_scope?(ancestor)
+            next unless ancestor.block_type?
+
+            ancestor.children.first.command? :class_methods
+          end
+        end
+
+        def in_def_class_methods_module?(node)
+          defn = node.ancestors.find do |ancestor|
+            break if new_lexical_scope?(ancestor)
+
+            ancestor.def_type?
+          end
+          return false unless defn
+
+          mod = defn.ancestors.find do |ancestor|
+            %i[class module].include?(ancestor.type)
+          end
+          return false unless mod
+
+          class_methods_module?(mod)
+        end
+
+        def in_def_module_function?(node)
+          defn = node.ancestors.find(&:def_type?)
+          return false unless defn
+
+          defn.left_siblings.any? { |sibling| module_function_bare_access_modifier?(sibling) } ||
+            defn.right_siblings.any? { |sibling| module_function_for?(sibling, defn.method_name) }
+        end
+
+        def in_class_eval?(node)
+          defn = node.ancestors.find do |ancestor|
+            break if ancestor.def_type? || new_lexical_scope?(ancestor)
+
+            ancestor.block_type?
+          end
+          return false unless defn
+
+          class_eval_scope?(defn)
+        end
+
+        def singleton_method_definition?(node)
+          node.ancestors.any? do |ancestor|
+            break if new_lexical_scope?(ancestor)
+            next unless ancestor.children.first.is_a? AST::SendNode
+
+            ancestor.children.first.command? :define_singleton_method
+          end
+        end
+
+        def method_definition?(node)
+          node.ancestors.any? do |ancestor|
+            break if new_lexical_scope?(ancestor)
+            next unless ancestor.children.first.is_a? AST::SendNode
+
+            ancestor.children.first.command? :define_method
+          end
+        end
+
+        def synchronized?(node)
+          node.ancestors.find do |ancestor|
+            next unless ancestor.block_type?
+
+            s = ancestor.children.first
+            s.send_type? && s.children.last == :synchronize
+          end
+        end
+
+        def instance_variable_call?(node)
+          instance_variable_set_call?(node) || instance_variable_get_call?(node)
+        end
+
+        def module_function_bare_access_modifier?(node)
+          return false unless node.respond_to?(:send_type?)
+
+          node.send_type? && node.bare_access_modifier? && node.method?(:module_function)
+        end
+
+        def match_name?(arg_name, method_name)
+          arg_name.to_sym == method_name.to_sym
+        end
+
+        # @!method class_methods_module?(node)
+        def_node_matcher :class_methods_module?, <<~PATTERN
+          (module (const _ :ClassMethods) ...)
+        PATTERN
+
+        # @!method module_function_for?(node)
+        def_node_matcher :module_function_for?, <<~PATTERN
+          (send nil? {:module_function} ({sym str} #match_name?(%1)))
+        PATTERN
+
+        # @!method new_lexical_scope?(node)
+        def_node_matcher :new_lexical_scope?, <<~PATTERN
+          {
+            (block (send (const nil? :Struct) :new ...) _ ({def defs} ...))
+            (block (send (const nil? :Class) :new ...) _ ({def defs} ...))
+            (block (send (const nil? :Data) :define ...) _ ({def defs} ...))
+            (block
+              (send nil?
+                {
+                  :prepend_around_action
+                  :prepend_before_action
+                  :before_action
+                  :append_before_action
+                  :around_action
+                  :append_around_action
+                  :append_after_action
+                  :after_action
+                  :prepend_after_action
+                }
+              )
+              ...
+            )
+          }
+        PATTERN
+
+        # @!method class_eval_scope?(node)
+        def_node_matcher :class_eval_scope?, <<~PATTERN
+          (block (send (const {nil? cbase} _) {:class_eval :class_exec}) ...)
+        PATTERN
+      end
+    end
+  end
+end

data/lib/rubocop/cop/thread_safety/dir_chdir.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module ThreadSafety
+      # Avoid using `Dir.chdir` due to its process-wide effect.
+      # If `AllowCallWithBlock` (disabled by default) option is enabled,
+      # calling `Dir.chdir` with block will be allowed.
+      #
+      # @example
+      #   # bad
+      #   Dir.chdir("/var/run")
+      #
+      #   # bad
+      #   FileUtils.chdir("/var/run")
+      #
+      # @example AllowCallWithBlock: false (default)
+      #   # good
+      #   Dir.chdir("/var/run") do
+      #     puts Dir.pwd
+      #   end
+      #
+      # @example AllowCallWithBlock: true
+      #   # bad
+      #   Dir.chdir("/var/run") do
+      #     puts Dir.pwd
+      #   end
+      #
+      class DirChdir < Base
+        MESSAGE = 'Avoid using `%<module>s%<dot>s%<method>s` due to its process-wide effect.'
+        RESTRICT_ON_SEND = %i[chdir cd].freeze
+
+        # @!method chdir?(node)
+        def_node_matcher :chdir?, <<~MATCHER
+          {
+            (call (const {nil? cbase} {:Dir :FileUtils}) :chdir ...)
+            (call (const {nil? cbase} :FileUtils) :cd ...)
+          }
+        MATCHER
+
+        def on_send(node)
+          return unless chdir?(node)
+          return if allow_call_with_block? && (node.block_argument? || node.parent&.block_type?)
+
+          add_offense(
+            node,
+            message: format(
+              MESSAGE,
+              module: node.receiver.short_name,
+              method: node.method_name,
+              dot: node.loc.dot.source
+            )
+          )
+        end
+        alias on_csend on_send
+
+        private
+
+        def allow_call_with_block?
+          !!cop_config['AllowCallWithBlock']
+        end
+      end
+    end
+  end
+end