rubocop 0.42.0 → 0.52.1

data/lib/rubocop/cop/registry.rb

@@ -0,0 +1,172 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    # Error raised when an unqualified cop name is used that could
+    # refer to two or more cops under different departments
+    class AmbiguousCopName < RuboCop::Error
+      MSG = 'Ambiguous cop name `%<name>s` used in %<origin>s needs ' \
+            'department qualifier. Did you mean %<options>s?'.freeze
+
+      def initialize(name, origin, badges)
+        super(
+          format(
+            MSG,
+            name: name,
+            origin: origin,
+            options: badges.to_a.join(' or ')
+          )
+        )
+      end
+    end
+
+    # Registry that tracks all cops by their badge and department.
+    class Registry
+      def initialize(cops = [])
+        @registry    = {}
+        @departments = {}
+
+        cops.each { |cop| enlist(cop) }
+      end
+
+      def enlist(cop)
+        @registry[cop.badge] = cop
+        @departments[cop.department] ||= []
+        @departments[cop.department] << cop
+      end
+
+      # @return [Array<Symbol>] list of departments for current cops.
+      def departments
+        @departments.keys
+      end
+
+      # @return [Registry] Cops for that specific department.
+      def with_department(department)
+        with(@departments.fetch(department, []))
+      end
+
+      # @return [Registry] Cops not for a specific department.
+      def without_department(department)
+        without_department = @departments.dup
+        without_department.delete(department)
+
+        with(without_department.values.flatten)
+      end
+
+      def contains_cop_matching?(names)
+        cops.any? { |cop| cop.match?(names) }
+      end
+
+      # Convert a user provided cop name into a properly namespaced name
+      #
+      # @example gives back a correctly qualified cop name
+      #
+      #   cops = RuboCop::Cop::Cop.all
+      #   cops.
+      #     qualified_cop_name('Layout/IndentArray') # => 'Layout/IndentArray'
+      #
+      # @example fixes incorrect namespaces
+      #
+      #   cops = RuboCop::Cop::Cop.all
+      #   cops.qualified_cop_name('Lint/IndentArray') # => 'Layout/IndentArray'
+      #
+      # @example namespaces bare cop identifiers
+      #
+      #   cops = RuboCop::Cop::Cop.all
+      #   cops.qualified_cop_name('IndentArray') # => 'Layout/IndentArray'
+      #
+      # @example passes back unrecognized cop names
+      #
+      #   cops = RuboCop::Cop::Cop.all
+      #   cops.qualified_cop_name('NotACop') # => 'NotACop'
+      #
+      # @param name [String] Cop name extracted from config
+      # @param path [String, nil] Path of file that `name` was extracted from
+      #
+      # @raise [AmbiguousCopName]
+      #   if a bare identifier with two possible namespaces is provided
+      #
+      # @note Emits a warning if the provided name has an incorrect namespace
+      #
+      # @return [String] Qualified cop name
+      def qualified_cop_name(name, path)
+        badge = Badge.parse(name)
+        return name if registered?(badge)
+
+        potential_badges = qualify_badge(badge)
+
+        case potential_badges.size
+        when 0 then name # No namespace found. Deal with it later in caller.
+        when 1 then resolve_badge(badge, potential_badges.first, path)
+        else raise AmbiguousCopName.new(badge, path, potential_badges)
+        end
+      end
+
+      def to_h
+        cops.group_by(&:cop_name)
+      end
+
+      def cops
+        @registry.values
+      end
+
+      def length
+        @registry.size
+      end
+
+      def enabled(config, only)
+        select do |cop|
+          config.for_cop(cop).fetch('Enabled') || only.include?(cop.cop_name)
+        end
+      end
+
+      def names
+        cops.map(&:cop_name)
+      end
+
+      def ==(other)
+        cops == other.cops
+      end
+
+      def sort!
+        @registry = Hash[@registry.sort_by { |badge, _| badge.cop_name }]
+
+        self
+      end
+
+      def select(&block)
+        cops.select(&block)
+      end
+
+      def each(&block)
+        cops.each(&block)
+      end
+
+      private
+
+      def with(cops)
+        self.class.new(cops)
+      end
+
+      def qualify_badge(badge)
+        @departments
+          .map { |department, _| badge.with_department(department) }
+          .select { |potential_badge| registered?(potential_badge) }
+      end
+
+      def resolve_badge(given_badge, real_badge, source_path)
+        unless given_badge.match?(real_badge)
+          path = PathUtil.smart_path(source_path)
+          warn "#{path}: #{given_badge} has the wrong namespace - " \
+               "should be #{real_badge.department}"
+        end
+
+        real_badge.to_s
+      end
+
+      def registered?(badge)
+        @registry.key?(badge)
+      end
+    end
+  end
+end

data/lib/rubocop/cop/security/eval.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Security
+      # This cop checks for the use of `Kernel#eval` and `Binding#eval`.
+      #
+      # @example
+      #
+      #   # bad
+      #
+      #   eval(something)
+      #   binding.eval(something)
+      class Eval < Cop
+        MSG = 'The use of `eval` is a serious security risk.'.freeze
+
+        def_node_matcher :eval?, <<-PATTERN
+          (send {nil? (send nil? :binding)} :eval $!str ...)
+        PATTERN
+
+        def on_send(node)
+          eval?(node) do |code|
+            return if code.dstr_type? && code.recursive_literal?
+            add_offense(node, location: :selector)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/security/json_load.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Security
+      # This cop checks for the use of JSON class methods which have potential
+      # security issues.
+      #
+      # Autocorrect is disabled by default because it's potentially dangerous.
+      # If using a stream, like `JSON.load(open('file'))`, it will need to call
+      # `#read` manually, like `JSON.parse(open('file').read)`.
+      # If reading single values (rather than proper JSON objects), like
+      # `JSON.load('false')`, it will need to pass the `quirks_mode: true`
+      # option, like `JSON.parse('false', quirks_mode: true)`.
+      # Other similar issues may apply.
+      #
+      # @example
+      #   # always offense
+      #   JSON.load("{}")
+      #   JSON.restore("{}")
+      #
+      #   # no offense
+      #   JSON.parse("{}")
+      #
+      class JSONLoad < Cop
+        MSG = 'Prefer `JSON.parse` over `JSON.%<method>s`.'.freeze
+
+        def_node_matcher :json_load, <<-PATTERN
+          (send (const {nil? cbase} :JSON) ${:load :restore} ...)
+        PATTERN
+
+        def on_send(node)
+          json_load(node) do |method|
+            add_offense(node,
+                        location: :selector,
+                        message: format(MSG, method: method))
+          end
+        end
+
+        def autocorrect(node)
+          ->(corrector) { corrector.replace(node.loc.selector, 'parse') }
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/security/marshal_load.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Security
+      # This cop checks for the use of Marshal class methods which have
+      # potential security issues leading to remote code execution when
+      # loading from an untrusted source.
+      #
+      # @example
+      #   # bad
+      #   Marshal.load("{}")
+      #   Marshal.restore("{}")
+      #
+      #   # good
+      #   Marshal.dump("{}")
+      #
+      #   # okish - deep copy hack
+      #   Marshal.load(Marshal.dump({}))
+      #
+      class MarshalLoad < Cop
+        MSG = 'Avoid using `Marshal.%<method>s`.'.freeze
+
+        def_node_matcher :marshal_load, <<-PATTERN
+          (send (const {nil? cbase} :Marshal) ${:load :restore}
+          !(send (const {nil? cbase} :Marshal) :dump ...))
+        PATTERN
+
+        def on_send(node)
+          marshal_load(node) do |method|
+            add_offense(node,
+                        location: :selector,
+                        message: format(MSG, method: method))
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/security/yaml_load.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Security
+      # This cop checks for the use of YAML class methods which have
+      # potential security issues leading to remote code execution when
+      # loading from an untrusted source.
+      #
+      # @example
+      #   # bad
+      #   YAML.load("--- foo")
+      #
+      #   # good
+      #   YAML.safe_load("--- foo")
+      #   YAML.dump("foo")
+      #
+      class YAMLLoad < Cop
+        MSG = 'Prefer using `YAML.safe_load` over `YAML.load`.'.freeze
+
+        def_node_matcher :yaml_load, <<-PATTERN
+          (send (const {nil? cbase} :YAML) :load ...)
+        PATTERN
+
+        def on_send(node)
+          yaml_load(node) do
+            add_offense(node, location: :selector)
+          end
+        end
+
+        def autocorrect(node)
+          ->(corrector) { corrector.replace(node.loc.selector, 'safe_load') }
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/severity.rb

@@ -1,4 +1,3 @@
-# encoding: utf-8
 # frozen_string_literal: true
 
 module RuboCop
@@ -8,7 +7,7 @@ module RuboCop
       include Comparable
 
       # @api private
-      NAMES = [:refactor, :convention, :warning, :error, :fatal].freeze
+      NAMES = %i[refactor convention warning error fatal].freeze
 
       # @api private
       CODE_TABLE = { R: :refactor, C: :convention,

data/lib/rubocop/cop/style/alias.rb

@@ -1,52 +1,54 @@
-# encoding: utf-8
 # frozen_string_literal: true
 
 module RuboCop
   module Cop
     module Style
-      # This cop finds uses of `alias` where `alias_method` would be more
-      # appropriate (or is simply preferred due to configuration), and vice
-      # versa.
-      # It also finds uses of `alias :symbol` rather than `alias bareword`.
+      # This cop enforces the use of either `#alias` or `#alias_method`
+      # depending on configuration.
+      # It also flags uses of `alias :symbol` rather than `alias bareword`.
+      #
+      # @example EnforcedStyle: prefer_alias (default)
+      #   # bad
+      #   alias_method :bar, :foo
+      #   alias :bar :foo
+      #
+      #   # good
+      #   alias bar foo
+      #
+      # @example EnforcedStyle: prefer_alias_method
+      #   # bad
+      #   alias :bar :foo
+      #   alias bar foo
+      #
+      #   # good
+      #   alias_method :bar, :foo
       class Alias < Cop
         include ConfigurableEnforcedStyle
 
         MSG_ALIAS = 'Use `alias_method` instead of `alias`.'.freeze
-        MSG_ALIAS_METHOD = 'Use `alias` instead of `alias_method` %s.'.freeze
-        MSG_SYMBOL_ARGS  = 'Use `alias %s` instead of `alias %s`.'.freeze
+        MSG_ALIAS_METHOD = 'Use `alias` instead of `alias_method` ' \
+                           '%<current>s.'.freeze
+        MSG_SYMBOL_ARGS  = 'Use `alias %<prefer>s` instead of ' \
+                           '`alias %<current>s`.'.freeze
 
         def on_send(node)
-          return unless node.method_name == :alias_method && node.receiver.nil?
-          return if style == :prefer_alias_method
-          return if scope_type(node) == :dynamic
+          return unless node.command?(:alias_method)
+          return unless style == :prefer_alias && alias_keyword_possible?(node)
 
-          msg = format(MSG_ALIAS_METHOD, lexical_scope_type(node))
-          add_offense(node, :selector, msg)
+          msg = format(MSG_ALIAS_METHOD, current: lexical_scope_type(node))
+          add_offense(node, location: :selector, message: msg)
         end
 
         def on_alias(node)
-          # alias_method can't be used with global variables
-          return if node.children.any?(&:gvar_type?)
-          # alias_method can't be used in instance_eval blocks
-          scope_type = scope_type(node)
-          return if scope_type == :instance_eval
-
-          if scope_type == :dynamic || style == :prefer_alias_method
-            add_offense(node, :keyword, MSG_ALIAS)
+          return unless alias_method_possible?(node)
+
+          if scope_type(node) == :dynamic || style == :prefer_alias_method
+            add_offense(node, location: :keyword, message: MSG_ALIAS)
           elsif node.children.none? { |arg| bareword?(arg) }
             add_offense_for_args(node)
           end
         end
 
-        def add_offense_for_args(node)
-          existing_args  = node.children.map(&:source).join(' ')
-          preferred_args = node.children.map { |a| a.source[1..-1] }.join(' ')
-          arg_ranges     = node.children.map(&:source_range)
-          msg            = format(MSG_SYMBOL_ARGS, preferred_args,
-                                  existing_args)
-          add_offense(node, arg_ranges.reduce(&:join), msg)
-        end
-
         def autocorrect(node)
           if node.send_type?
             correct_alias_method_to_alias(node)
@@ -59,6 +61,25 @@ module RuboCop
 
         private
 
+        def alias_keyword_possible?(node)
+          scope_type(node) != :dynamic && node.arguments.all?(&:sym_type?)
+        end
+
+        def alias_method_possible?(node)
+          scope_type(node) != :instance_eval &&
+            node.children.none?(&:gvar_type?)
+        end
+
+        def add_offense_for_args(node)
+          existing_args  = node.children.map(&:source).join(' ')
+          preferred_args = node.children.map { |a| a.source[1..-1] }.join(' ')
+          arg_ranges     = node.children.map(&:source_range)
+          msg            = format(MSG_SYMBOL_ARGS,
+                                  prefer: preferred_args,
+                                  current: existing_args)
+          add_offense(node, location: arg_ranges.reduce(&:join), message: msg)
+        end
+
         # In this expression, will `self` be the same as the innermost enclosing
         # class or module block (:lexical)? Or will it be something else
         # (:dynamic)? If we're in an instance_eval block, return that.
@@ -87,14 +108,14 @@ module RuboCop
         end
 
         def bareword?(sym_node)
-          sym_node.source[0] != ':'
+          !sym_node.source.start_with?(':')
         end
 
-        def correct_alias_method_to_alias(node)
+        def correct_alias_method_to_alias(send_node)
           lambda do |corrector|
-            new, old = *node.method_args
+            new, old = *send_node.arguments
             replacement = "alias #{new.children.first} #{old.children.first}"
-            corrector.replace(node.source_range, replacement)
+            corrector.replace(send_node.source_range, replacement)
           end
         end
 

data/lib/rubocop/cop/style/and_or.rb

@@ -1,87 +1,107 @@
-# encoding: utf-8
 # frozen_string_literal: true
 
 module RuboCop
   module Cop
     module Style
-      # This cop checks for uses of *and* and *or*.
+      # This cop checks for uses of `and` and `or`, and suggests using `&&` and
+      # `|| instead`. It can be configured to check only in conditions, or in
+      # all contexts.
+      #
+      # @example EnforcedStyle: always (default)
+      #   # bad
+      #   foo.save and return
+      #
+      #   # bad
+      #   if foo and bar
+      #   end
+      #
+      #   # good
+      #   foo.save && return
+      #
+      #   # good
+      #   if foo && bar
+      #   end
+      #
+      # @example EnforcedStyle: conditionals
+      #   # bad
+      #   if foo and bar
+      #   end
+      #
+      #   # good
+      #   foo.save && return
+      #
+      #   # good
+      #   foo.save and return
+      #
+      #   # good
+      #   if foo && bar
+      #   end
       class AndOr < Cop
         include ConfigurableEnforcedStyle
 
-        MSG = 'Use `%s` instead of `%s`.'.freeze
-
-        OPS = { 'and' => '&&', 'or' => '||' }.freeze
+        MSG = 'Use `%<prefer>s` instead of `%<current>s`.'.freeze
 
         def on_and(node)
-          process_logical_op(node) if style == :always
-        end
-
-        def on_or(node)
-          process_logical_op(node) if style == :always
+          process_logical_operator(node) if style == :always
         end
+        alias on_or on_and
 
         def on_if(node)
           on_conditionals(node) if style == :conditionals
         end
+        alias on_while      on_if
+        alias on_while_post on_if
+        alias on_until      on_if
+        alias on_until_post on_if
 
-        def on_while(node)
-          on_conditionals(node) if style == :conditionals
-        end
-
-        def on_while_post(node)
-          on_conditionals(node) if style == :conditionals
-        end
-
-        def on_until(node)
-          on_conditionals(node) if style == :conditionals
-        end
+        def autocorrect(node)
+          lambda do |corrector|
+            node.each_child_node do |expr|
+              if expr.send_type?
+                correct_send(expr, corrector)
+              elsif expr.return_type?
+                correct_other(expr, corrector)
+              elsif expr.assignment?
+                correct_other(expr, corrector)
+              end
+            end
 
-        def on_until_post(node)
-          on_conditionals(node) if style == :conditionals
+            corrector.replace(node.loc.operator, node.alternate_operator)
+          end
         end
 
         private
 
         def on_conditionals(node)
-          condition_node, = *node
-
-          condition_node.each_node(:and, :or) do |logical_node|
-            process_logical_op(logical_node)
+          node.condition.each_node(*LOGICAL_OPERATOR_NODES) do |logical_node|
+            process_logical_operator(logical_node)
           end
         end
 
-        def process_logical_op(node)
-          op = node.loc.operator.source
-          op_type = node.type.to_s
-          return unless op == op_type
+        def process_logical_operator(node)
+          return if node.logical_operator?
 
-          add_offense(node, :operator, format(MSG, OPS[op], op))
+          add_offense(node, location: :operator)
         end
 
-        def autocorrect(node)
-          expr1, expr2 = *node
-          replacement = (node.type == :and ? '&&' : '||')
-          lambda do |corrector|
-            [expr1, expr2].each do |expr|
-              if expr.send_type?
-                correct_send(expr, corrector)
-              elsif expr.return_type?
-                correct_other(expr, corrector)
-              elsif expr.assignment?
-                correct_other(expr, corrector)
-              end
-            end
-            corrector.replace(node.loc.operator, replacement)
-          end
+        def message(node)
+          format(MSG, prefer: node.alternate_operator, current: node.operator)
         end
 
         def correct_send(node, corrector)
-          receiver, method_name, *args = *node
-          return correct_not(node, receiver, corrector) if method_name == :!
+          return correct_not(node, node.receiver, corrector) if node.method?(:!)
+          return correct_setter(node, corrector) if node.setter_method?
+          return correct_other(node, corrector) if node.comparison_method?
+
           return unless correctable_send?(node)
 
-          corrector.replace(whitespace_before_arg(node), '('.freeze)
-          corrector.insert_after(args.last.source_range, ')'.freeze)
+          corrector.replace(whitespace_before_arg(node), '(')
+          corrector.insert_after(node.last_argument.source_range, ')')
+        end
+
+        def correct_setter(node, corrector)
+          corrector.insert_before(node.receiver.source_range, '(')
+          corrector.insert_after(node.last_argument.source_range, ')')
         end
 
         # ! is a special case:
@@ -89,7 +109,7 @@ module RuboCop
         # recurse down a level and add parens to 'obj.method arg'
         # however, 'not x' also parses as (send x :!)
         def correct_not(node, receiver, corrector)
-          if node.loc.selector.source == '!'
+          if node.keyword_bang?
             return unless receiver.send_type?
 
             correct_send(receiver, corrector)
@@ -101,29 +121,23 @@ module RuboCop
         end
 
         def correct_other(node, corrector)
-          return unless node.source_range.begin.source != '('
+          return if node.source_range.begin.is?('(')
+
           corrector.insert_before(node.source_range, '(')
           corrector.insert_after(node.source_range, ')')
         end
 
         def correctable_send?(node)
-          _receiver, method_name, *args = *node
-          # don't clobber if we already have a starting paren
-          return false unless !node.loc.begin || node.loc.begin.source != '('
-          # don't touch anything unless we are sure it is a method call.
-          return false unless args.last && method_name.to_s =~ /[a-z]/
-
-          true
+          !node.parenthesized? && node.arguments? && !node.method?(:[])
         end
 
         def whitespace_before_arg(node)
-          sb = node.source_range.source_buffer
           begin_paren = node.loc.selector.end_pos
           end_paren = begin_paren
           # Increment position of parenthesis, unless message is a predicate
           # method followed by a non-whitespace char (e.g. is_a?String).
-          end_paren += 1 unless node.source =~ /\?[!\S]/
-          Parser::Source::Range.new(sb, begin_paren, end_paren)
+          end_paren += 1 unless node.source =~ /\?\S/
+          range_between(begin_paren, end_paren)
         end
       end
     end