rubocop 0.40.0 → 0.41.0

data/lib/rubocop/cop/rails/exit.rb

@@ -0,0 +1,62 @@
+# encoding: utf-8
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Rails
+      # This cop enforces that 'exit' calls are not used within a rails app.
+      # Valid options are instead to raise an error, break, return or some
+      # other form of stopping execution of current request.
+      #
+      # There are two obvious cases where 'exit' is particularly harmful:
+      #
+      # - Usage in library code for your application. Even though rails will
+      # rescue from a SystemExit and continue on, unit testing that library
+      # code will result in specs exiting (potentially silently if exit(0)
+      # is used.)
+      # - Usage in application code outside of the web process could result in
+      # the program exiting, which could result in the code failing to run and
+      # do its job.
+      class Exit < Cop
+        include ConfigurableEnforcedStyle
+
+        MSG = 'Do not use `exit` in Rails applications.'.freeze
+        TARGET_METHODS = [:exit, :exit!].freeze
+        EXPLICIT_RECEIVERS = [:Kernel, :Process].freeze
+
+        def on_send(node)
+          add_offense(node, :selector) if offending_node?(node)
+        end
+
+        private
+
+        def offending_node?(node)
+          receiver_node, method_name, *arg_nodes = *node
+
+          right_method_name?(method_name) &&
+            right_argument_count?(arg_nodes) &&
+            right_receiver?(receiver_node)
+        end
+
+        def right_method_name?(method_name)
+          TARGET_METHODS.include?(method_name)
+        end
+
+        # More than 1 argument likely means it is a different
+        # `exit` implementation than the one we are preventing.
+        def right_argument_count?(arg_nodes)
+          arg_nodes.length <= 1
+        end
+
+        # Only register if exit is being called explicitly on
+        # Kernel or Process or if receiver node is nil for plain
+        # `exit` calls.
+        def right_receiver?(receiver_node)
+          return true if receiver_node.nil?
+          _a, receiver_node_class, _c = *receiver_node
+          EXPLICIT_RECEIVERS.include?(receiver_node_class)
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/rails/output_safety.rb

@@ -0,0 +1,45 @@
+# encoding: utf-8
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Rails
+      # This cop checks for the use of output safety calls like html_safe and
+      # raw.
+      #
+      # @example
+      #   # bad
+      #   "<p>#{text}</p>".html_safe
+      #
+      #   # good
+      #   content_tag(:p, text)
+      #
+      #   # bad
+      #   out = ""
+      #   out << content_tag(:li, "one")
+      #   out << content_tag(:li, "two")
+      #   out.html_safe
+      #
+      #   # good
+      #   out = []
+      #   out << content_tag(:li, "one")
+      #   out << content_tag(:li, "two")
+      #   safe_join(out)
+      #
+      class OutputSafety < Cop
+        MSG = 'Tagging a string as html safe may be a security risk, \
+          prefer `safe_join` or other Rails tag helpers instead'.freeze
+
+        def on_send(node)
+          receiver, method_name, *_args = *node
+
+          if receiver && method_name == :html_safe
+            add_offense(node, :selector)
+          elsif receiver.nil? && method_name == :raw
+            add_offense(node, :selector)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/rails/pluralization_grammar.rb

@@ -31,15 +31,15 @@ module RuboCop
 
         def on_send(node)
           receiver, method_name, *_args = *node
-          return if receiver.nil?
           return unless duration_method?(method_name)
           return unless literal_number?(receiver)
+
           number, = *receiver
-          if singular_receiver?(number) && plural_method?(method_name)
+          if expect_singular_method?(number, method_name)
             add_offense(node,
                         :expression,
                         format(MSG, number, singularize(method_name)))
-          elsif plural_receiver?(number) && singular_method?(method_name)
+          elsif expect_plural_method?(number, method_name)
             add_offense(node,
                         :expression,
                         format(MSG, number, pluralize(method_name)))
@@ -60,6 +60,14 @@ module RuboCop
           end
         end
 
+        def expect_singular_method?(number, method_name)
+          singular_receiver?(number) && plural_method?(method_name)
+        end
+
+        def expect_plural_method?(number, method_name)
+          plural_receiver?(number) && singular_method?(method_name)
+        end
+
         def plural_method?(method_name)
           method_name.to_s.end_with?('s')
         end
@@ -77,7 +85,7 @@ module RuboCop
         end
 
         def literal_number?(node)
-          node.int_type? || node.float_type?
+          node && (node.int_type? || node.float_type?)
         end
 
         def pluralize(method_name)

data/lib/rubocop/cop/rails/request_referer.rb

@@ -0,0 +1,40 @@
+# encoding: utf-8
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Rails
+      # This cop checks for consistent uses of request.referrer or
+      # request.referrer, depending on configuration.
+      class RequestReferer < Cop
+        include ConfigurableEnforcedStyle
+
+        def on_send(node)
+          if offense?(node)
+            add_offense(node.source_range, node.source_range, message)
+          end
+        end
+
+        def autocorrect(node)
+          ->(corrector) { corrector.replace(node, "request.#{style}") }
+        end
+
+        private
+
+        def offense?(node)
+          return false unless node.receiver
+          receiver_name = node.receiver.method_name
+          receiver_name == :request && node.method_name == wrong_method_name
+        end
+
+        def message
+          "Use `request.#{style}` instead of `request.#{wrong_method_name}`."
+        end
+
+        def wrong_method_name
+          style == :referer ? :referrer : :referer
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/rails/uniq_before_pluck.rb

@@ -4,51 +4,86 @@
 module RuboCop
   module Cop
     module Rails
-      # Prefer the use of uniq before pluck instead of after.
+      # Prefer the use of uniq (or distinct), before pluck instead of after.
       #
-      # The use of uniq before pluck is preferred because it executes
-      # within the database.
+      # The use of uniq before pluck is preferred because it executes within
+      # the database.
       #
       # @example
       #   # bad
-      #   Model.where(...).pluck(:id).uniq
+      #   Model.pluck(:id).uniq
       #
       #   # good
-      #   Model.where(...).uniq.pluck(:id)
+      #   Model.uniq.pluck(:id)
+      #
+      # This cop has two different enforcement modes. When the EnforcementMode
+      # is conservative (the default) then only calls to pluck on a constant
+      # (i.e. a model class) before uniq are added as offenses.
+      #
+      # When the EnforcementMode is aggressive then all calls to pluck before
+      # uniq are added as offenses. This may lead to false positives as the cop
+      # cannot distinguish between calls to pluck on an ActiveRecord::Relation
+      # vs a call to pluck on an ActiveRecord::Associations::CollectionProxy.
+      #
+      # @example
+      #   # this will return a Relation that pluck is called on
+      #   Model.where(...).pluck(:id).uniq
+      #
+      #   # an association on an instance will return a CollectionProxy
+      #   instance.assoc.pluck(:id).uniq
+      #
+      # Autocorrect is disabled by default for this cop since it may generate
+      # false positives.
       #
       class UniqBeforePluck < RuboCop::Cop::Cop
-        MSG = 'Use uniq before pluck'.freeze
-        DOT_UNIQ = '.uniq'.freeze
+        MSG = 'Use `%s` before `pluck`'.freeze
         NEWLINE = "\n".freeze
+        PATTERN = '[!^block (send (send %s :pluck ...) ${:uniq :distinct} ...)]'
+                  .freeze
+
+        def_node_matcher :conservative_node_match,
+                         format(PATTERN, 'const')
+
+        def_node_matcher :aggressive_node_match,
+                         format(PATTERN, '_')
 
         def on_send(node)
-          receiver, method_name, *_args = *node
+          method = if mode == :conservative
+                     conservative_node_match(node)
+                   else
+                     aggressive_node_match(node)
+                   end
 
-          unless method_name == :uniq &&
-                 !receiver.nil? &&
-                 receiver.send_type? &&
-                 receiver.children[1] == :pluck
-            return
-          end
-          add_offense(node, :selector, MSG)
+          add_offense(node, :selector, format(MSG, method)) if method
         end
 
         def autocorrect(node)
+          send_pluck, method, *_args = *node
+          lambda do |corrector|
+            corrector.remove(dot_method_with_whitespace(method, node))
+            corrector.insert_before(send_pluck.loc.dot.begin, ".#{method}")
+          end
+        end
+
+        private
+
+        def mode
+          @mode ||= cop_config['EnforcedMode'].to_sym
+        end
+
+        def dot_method_with_whitespace(method, node)
+          Parser::Source::Range.new(node.loc.expression.source_buffer,
+                                    dot_method_begin_pos(method, node),
+                                    node.loc.selector.end_pos)
+        end
+
+        def dot_method_begin_pos(method, node)
           lines = node.source.split(NEWLINE)
-          begin_remove_pos = if lines.last.strip == DOT_UNIQ
-                               node.source.rindex(NEWLINE)
-                             else
-                               node.loc.dot.begin_pos
-                             end
-          receiver = node.children.first
 
-          lambda do |corrector|
-            corrector.remove(
-              Parser::Source::Range.new(node.loc.expression.source_buffer,
-                                        begin_remove_pos,
-                                        node.loc.selector.end_pos)
-            )
-            corrector.insert_before(receiver.loc.dot.begin, DOT_UNIQ)
+          if lines.last.strip == ".#{method}"
+            node.source.rindex(NEWLINE)
+          else
+            node.loc.dot.begin_pos
           end
         end
       end

data/lib/rubocop/cop/rails/validation.rb

@@ -8,29 +8,22 @@ module RuboCop
       class Validation < Cop
         MSG = 'Prefer the new style validations `%s` over `%s`.'.freeze
 
-        BLACKLIST = [:validates_acceptance_of,
-                     :validates_confirmation_of,
-                     :validates_exclusion_of,
-                     :validates_format_of,
-                     :validates_inclusion_of,
-                     :validates_length_of,
-                     :validates_numericality_of,
-                     :validates_presence_of,
-                     :validates_size_of,
-                     :validates_uniqueness_of].freeze
-
-        WHITELIST = [
-          'validates :column, acceptance: value',
-          'validates :column, confirmation: value',
-          'validates :column, exclusion: value',
-          'validates :column, format: value',
-          'validates :column, inclusion: value',
-          'validates :column, length: value',
-          'validates :column, numericality: value',
-          'validates :column, presence: value',
-          'validates :column, size: value',
-          'validates :column, uniqueness: value'
-        ].freeze
+        TYPES = %w(
+          acceptance
+          confirmation
+          exclusion
+          format
+          inclusion
+          length
+          numericality
+          presence
+          size
+          uniqueness
+        ).freeze
+
+        BLACKLIST = TYPES.map { |p| "validates_#{p}_of".to_sym }.freeze
+
+        WHITELIST = TYPES.map { |p| "validates :column, #{p}: value" }.freeze
 
         def on_send(node)
           receiver, method_name, *_args = *node
@@ -48,6 +41,27 @@ module RuboCop
         def preferred_method(method)
           WHITELIST[BLACKLIST.index(method.to_sym)]
         end
+
+        def autocorrect(node)
+          _receiver, method_name, *args = *node
+          options = args.find { |arg| arg.type != :sym }
+          lambda do |corrector|
+            validate_type = method_name.to_s.split('_')[1]
+            corrector.replace(node.loc.selector, 'validates')
+            cop_config['AllowUnusedKeywordArguments']
+            if options
+              corrector.replace(
+                options.loc.expression,
+                "#{validate_type}: { #{options.source} }"
+              )
+            else
+              corrector.insert_after(
+                node.loc.expression,
+                ", #{validate_type}: true"
+              )
+            end
+          end
+        end
       end
     end
   end

data/lib/rubocop/cop/style/alias.rb

@@ -34,15 +34,19 @@ module RuboCop
           if scope_type == :dynamic || style == :prefer_alias_method
             add_offense(node, :keyword, MSG_ALIAS)
           elsif node.children.none? { |arg| bareword?(arg) }
-            existing_args  = node.children.map(&:source).join(' ')
-            preferred_args = node.children.map { |a| a.source[1..-1] }.join(' ')
-            arg_ranges     = node.children.map(&:source_range)
-            msg            = format(MSG_SYMBOL_ARGS, preferred_args,
-                                    existing_args)
-            add_offense(node, arg_ranges.reduce(&:join), msg)
+            add_offense_for_args(node)
           end
         end
 
+        def add_offense_for_args(node)
+          existing_args  = node.children.map(&:source).join(' ')
+          preferred_args = node.children.map { |a| a.source[1..-1] }.join(' ')
+          arg_ranges     = node.children.map(&:source_range)
+          msg            = format(MSG_SYMBOL_ARGS, preferred_args,
+                                  existing_args)
+          add_offense(node, arg_ranges.reduce(&:join), msg)
+        end
+
         def autocorrect(node)
           if node.send_type?
             correct_alias_method_to_alias(node)

data/lib/rubocop/cop/style/bare_percent_literals.rb

@@ -25,13 +25,24 @@ module RuboCop
           return unless node.loc.respond_to?(:begin)
           return unless node.loc.begin
 
-          msg = case node.loc.begin.source
-                when /^%[^\w]/
-                  format(MSG, 'Q', '') if style == :percent_q
-                when /^%Q/
-                  format(MSG, '', 'Q') if style == :bare_percent
-                end
-          add_offense(node, :begin, msg) if msg
+          source = node.loc.begin.source
+          if requires_percent_q?(source)
+            add_offense_for_wrong_style(node, 'Q', '')
+          elsif requires_bare_percent?(source)
+            add_offense_for_wrong_style(node, '', 'Q')
+          end
+        end
+
+        def requires_percent_q?(source)
+          style == :percent_q && source =~ /^%[^\w]/
+        end
+
+        def requires_bare_percent?(source)
+          style == :bare_percent && source =~ /^%Q/
+        end
+
+        def add_offense_for_wrong_style(node, good, bad)
+          add_offense(node, :begin, format(MSG, good, bad))
         end
 
         def autocorrect(node)

data/lib/rubocop/cop/style/block_delimiters.rb

@@ -9,26 +9,25 @@ module RuboCop
       class BlockDelimiters < Cop
         include ConfigurableEnforcedStyle
 
-        def_node_matcher :block_method_name, '(block (send _ $_ ...) ...)'
-
         def on_send(node)
           _receiver, method_name, *args = *node
           return if args.empty?
           return if parentheses?(node) || operator?(method_name)
 
-          get_blocks(args.last) do |block|
-            # If there are no parentheses around the arguments, then braces and
-            # do-end have different meaning due to how they bind, so we allow
-            # either.
-            ignore_node(block)
+          args.each do |arg|
+            get_blocks(arg) do |block|
+              # If there are no parentheses around the arguments, then braces
+              # and do-end have different meaning due to how they bind, so we
+              # allow either.
+              ignore_node(block)
+            end
           end
         end
 
         def on_block(node)
           return if ignored_node?(node)
-          return if proper_block_style?(node)
 
-          add_offense(node, :begin)
+          add_offense(node, :begin) unless proper_block_style?(node)
         end
 
         private
@@ -65,12 +64,9 @@ module RuboCop
 
         def message(node)
           case style
-          when :line_count_based
-            line_count_based_message(node)
-          when :semantic
-            semantic_message(node)
-          when :braces_for_chaining
-            braces_for_chaining_message(node)
+          when :line_count_based    then line_count_based_message(node)
+          when :semantic            then semantic_message(node)
+          when :braces_for_chaining then braces_for_chaining_message(node)
           end
         end
 
@@ -117,12 +113,9 @@ module RuboCop
 
         def proper_block_style?(node)
           case style
-          when :line_count_based
-            line_count_based_block_style?(node)
-          when :semantic
-            semantic_block_style?(node)
-          when :braces_for_chaining
-            braces_for_chaining_style?(node)
+          when :line_count_based    then line_count_based_block_style?(node)
+          when :semantic            then semantic_block_style?(node)
+          when :braces_for_chaining then braces_for_chaining_style?(node)
           end
         end
 
@@ -133,7 +126,7 @@ module RuboCop
         end
 
         def semantic_block_style?(node)
-          method_name = block_method_name(node)
+          method_name = node.method_name
           return true if ignored_method?(method_name)
 
           block_begin = node.loc.begin.source