rubocop-vendor 0.11.0 → 0.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f69fd94e8d9429fec0334913a5d2bcfa8f2e2873e777ec17879a37d0ca044eb6
-  data.tar.gz: 6a012a6071337d04d50cefd51ddc07c63abe07f96f70eae9acd094e9a8d8ee27
+  metadata.gz: 5e8a207496eb8ecac737af481053083a942d3ad3bbbdabe19c0786afbabff226
+  data.tar.gz: 0636c9d456890e9ff0cbf0dd58844d9d84d0b9720c52f242d993a45d06d7562f
 SHA512:
-  metadata.gz: 6406158144116b3cc61af8e30c8e68c2285073b8eb5ed0ed2fba58f7570a3c5d73732a1ed331beb1333957e08606228faefc1bd1803fdac34d2ab903015d8008
-  data.tar.gz: 470e41a804dba4c86ac1b8654a2204fdf4de33dec852d1c185e98b9fbc2f509cf28e7eec4a7fed575374c0cf23cc45cb19ffb30abc2caa6fb89f9b4898c0730d
+  metadata.gz: 9b9fd407aace500ee8a51d024e476213cc4a525d2f18f413059ba32c76d418d79407c1d421550de51ebcda4543b7396a42b9e95a73497a39c4e4a5f0e8ac2104
+  data.tar.gz: 45aa5f974f41e6e8ce97f58366ca5c98e981861edf5aaac45f3653abe03a9b1d80c6e8f1b2ed74a6c06b6454f5bcb3c7ed98b6417fa868663e09db154d499926

data/lib/rubocop/cop/vendor/ws_sdk_path_array_slash.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require 'parser/current'
+
+module RuboCop
+  module Cop
+    module Vendor
+      # This cop checks for `Ws::Service#get,patch,post,put,delete,...` usage
+      # where the array format is used, but it contains (probably not) intended slashes.
+      # These slashes will be converted to %2f instead of a path component.
+      #
+      # @example
+      #   # bad
+      #   Ws::AccountService.post(["/test/foo"]) # forward flash will be converted to %2f
+      #
+      #   # good
+      #   Ws::AccountService.post(["test", "foo"])
+      #
+      class WsSdkPathArraySlash < Base
+        extend AutoCorrector
+
+        MSG = <<-STR.strip
+          When switching to array arguments, you must put each path component individually
+        STR
+        HTTP_METHODS = Set[:get, :patch, :put, :post, :delete, :head, :options, :trace]
+
+        # @!method ws_sdk_service_call?(node)
+        def_node_matcher :ws_sdk_service_call?, <<-PATTERN, method: HTTP_METHODS
+          (send (const (const _ :Ws) _) %method $...)
+        PATTERN
+
+        def on_send(node)
+          path, = ws_sdk_service_call?(node)
+          return unless path&.array_type?
+
+          strings_with_slash = path.children.select { |n| n.str_type? && n.value.include?('/') }
+
+          strings_with_slash.each do |str_node|
+            add_offense(str_node) do |corrector|
+              correct_path(corrector, path)
+            end
+          end
+        end
+
+        private
+
+        def correct_path(corrector, path)
+          parts =
+            path.children.flat_map do |child|
+              if child.str_type? && child.value.include?('/')
+                child.value.delete_prefix('/').delete_suffix('/').split('/').map { |v| "\"#{v}\"" }
+              else
+                [child.source]
+              end
+            end
+          corrector.replace(path.loc.expression, "[#{parts.join(', ')}]")
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/vendor/ws_sdk_path_injection.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require 'parser/current'
+
+module RuboCop
+  module Cop
+    module Vendor
+      # This cop checks for `Ws::Service#get,patch,post,put,delete,...` usage and suggests to use component based paths
+      # instead of using interpolated values that could be user input.
+      #
+      # This is to avoid path injection, a potential security vulnerability!
+      #
+      # @example
+      #   # bad
+      #   # could post to /api/accounts with same credentials (e.g. by passing "?" as account_id)
+      #   Ws::AccountService.post("/api/accounts/#{account_id}/details")
+      #
+      #   # good
+      #   Ws::AccountService.post(["api","accounts", account_id, "details"])
+      #
+      #   # okay, but prefer above
+      #   Ws::AccountService.post("/api/accounts/#{URI.encode_www_component(account_id)}")
+      #
+      class WsSdkPathInjection < Base
+        extend AutoCorrector
+
+        MSG = <<-STR.strip
+          Use of paths with interpolated values is dangerous, as path injection can occur; prefer to use array of each path component
+        STR
+        HTTP_METHODS = Set[:get, :patch, :put, :post, :delete, :head, :options, :trace]
+
+        # @!method ws_sdk_service_call?(node)
+        def_node_matcher :ws_sdk_service_call?, <<-PATTERN, method: HTTP_METHODS
+          (send (const (const _ :Ws) _) %method $...)
+        PATTERN
+
+        def on_send(node)
+          return unless self.class.ws_sdk_supports_arrays?
+
+          path, = ws_sdk_service_call?(node)
+          return unless path && path.type != :array
+
+          add_offense(path) do |corrector|
+            correct_path(corrector, path)
+          end
+        end
+
+        def self.ws_sdk_supports_arrays?
+          version = Gem.loaded_specs['ws-sdk']&.version
+          version && version >= Gem::Version.new('13.3.0')
+        end
+
+        private
+
+        def correct_path(corrector, path)
+          parts =
+            if path.send_type?
+              [path.source]
+            else
+              convert_str_path_to_source(path)
+            end
+          return unless parts # conversion to parts failed, cannot auto-correct
+
+          corrector.replace(path.loc.expression, "[#{parts.join(', ')}]")
+        end
+
+        def convert_str_path_to_source(path)
+          path.children.flat_map do |child|
+            case child&.type
+            when :str
+              convert_str_node_to_array_source(child)
+            when :begin # begin interpolation
+              child.children.first.source
+            when :send
+              child.source
+            else
+              break # do not know how to auto-correct other types
+            end
+          end
+        end
+
+        def convert_str_node_to_array_source(node)
+          node.value.delete_prefix('/').delete_suffix('/').split('/').map { |v| "\"#{v}\"" }
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/vendor_cops.rb

@@ -13,3 +13,5 @@ require_relative 'vendor/rollbar_log'
 require_relative 'vendor/rollbar_logger'
 require_relative 'vendor/rollbar_with_exception'
 require_relative 'vendor/strict_dry_struct'
+require_relative 'vendor/ws_sdk_path_array_slash'
+require_relative 'vendor/ws_sdk_path_injection'

data/lib/rubocop/vendor/version.rb

@@ -2,6 +2,6 @@
 
 module RuboCop
   module Vendor
-    VERSION = '0.11.0'
+    VERSION = '0.12.0'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubocop-vendor
 version: !ruby/object:Gem::Version
-  version: 0.11.0
+  version: 0.12.0
 platform: ruby
 authors:
 - Danilo Cabello
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-05-26 00:00:00.000000000 Z
+date: 2023-08-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rubocop
@@ -93,6 +93,8 @@ files:
 - lib/rubocop/cop/vendor/rollbar_with_exception.rb
 - lib/rubocop/cop/vendor/sidekiq_throttled_gem.rb
 - lib/rubocop/cop/vendor/strict_dry_struct.rb
+- lib/rubocop/cop/vendor/ws_sdk_path_array_slash.rb
+- lib/rubocop/cop/vendor/ws_sdk_path_injection.rb
 - lib/rubocop/cop/vendor_cops.rb
 - lib/rubocop/vendor.rb
 - lib/rubocop/vendor/inject.rb