rubocop 0.52.1 → 0.53.0

data/lib/rubocop/cop/rails/reversible_migration.rb

@@ -126,7 +126,7 @@ module RuboCop
       #
       # @see http://api.rubyonrails.org/classes/ActiveRecord/Migration/CommandRecorder.html
       class ReversibleMigration < Cop
-        MSG = '%s is not reversible.'.freeze
+        MSG = '%<action>s is not reversible.'.freeze
         IRREVERSIBLE_CHANGE_TABLE_CALLS = %i[
           change change_default remove
         ].freeze
@@ -177,7 +177,7 @@ module RuboCop
 
         def check_irreversible_schema_statement_node(node)
           irreversible_schema_statement_call(node) do |method_name|
-            add_offense(node, message: format(MSG, method_name))
+            add_offense(node, message: format(MSG, action: method_name))
           end
         end
 
@@ -186,7 +186,7 @@ module RuboCop
             unless node.parent.block_type?
               add_offense(
                 node,
-                message: format(MSG, 'drop_table(without block)')
+                message: format(MSG, action: 'drop_table(without block)')
               )
             end
           end
@@ -198,7 +198,7 @@ module RuboCop
               add_offense(
                 node,
                 message: format(
-                  MSG, 'change_column_default(without :from and :to)'
+                  MSG, action: 'change_column_default(without :from and :to)'
                 )
               )
             end
@@ -210,7 +210,7 @@ module RuboCop
             if args.to_a.size < 3
               add_offense(
                 node,
-                message: format(MSG, 'remove_column(without type)')
+                message: format(MSG, action: 'remove_column(without type)')
               )
             end
           end
@@ -221,7 +221,8 @@ module RuboCop
             if arg.hash_type?
               add_offense(
                 node,
-                message: format(MSG, 'remove_foreign_key(without table)')
+                message: format(MSG,
+                                action: 'remove_foreign_key(without table)')
               )
             end
           end
@@ -232,7 +233,7 @@ module RuboCop
             if target_rails_version < 4.0
               add_offense(
                 node,
-                message: format(MSG, 'change_table')
+                message: format(MSG, action: 'change_table')
               )
             elsif block.send_type?
               check_change_table_offense(arg, block)
@@ -250,7 +251,7 @@ module RuboCop
                     !IRREVERSIBLE_CHANGE_TABLE_CALLS.include?(method_name)
           add_offense(
             node,
-            message: format(MSG, "change_table(with #{method_name})")
+            message: format(MSG, action: "change_table(with #{method_name})")
           )
         end
 

data/lib/rubocop/cop/rails/safe_navigation.rb

@@ -41,8 +41,9 @@ module RuboCop
       #     foo&.bar { |e| e.baz }
       class SafeNavigation < Cop
         extend TargetRubyVersion
+        include RangeHelp
 
-        MSG = 'Use safe navigation (`&.`) instead of `%s`.'.freeze
+        MSG = 'Use safe navigation (`&.`) instead of `%<try>s`.'.freeze
 
         def_node_matcher :try_call, <<-PATTERN
           (send !nil? ${:try :try!} $_ ...)
@@ -55,7 +56,7 @@ module RuboCop
             return if try_method == :try && !cop_config['ConvertTry']
             return unless dispatch.sym_type? && dispatch.value =~ /\w+[=!?]?/
 
-            add_offense(node, message: format(MSG, try_method))
+            add_offense(node, message: format(MSG, try: try_method))
           end
         end
 

data/lib/rubocop/cop/rails/save_bang.rb

@@ -36,13 +36,13 @@ module RuboCop
       #     # ...
       #   end
       class SaveBang < Cop
-        MSG = 'Use `%s` instead of `%s` if the return value is not checked.'
-              .freeze
+        MSG = 'Use `%<prefer>s` instead of `%<current>s` if the return ' \
+              'value is not checked.'.freeze
         CREATE_MSG = (MSG +
-                      ' Or check `persisted?` on model returned from `%s`.')
-                     .freeze
-        CREATE_CONDITIONAL_MSG = '`%s` returns a model which is always truthy.'
-                                 .freeze
+                      ' Or check `persisted?` on model returned from ' \
+                      '`%<current>s`.').freeze
+        CREATE_CONDITIONAL_MSG = '`%<method>s` returns a model which is ' \
+                                 'always truthy.'.freeze
 
         CREATE_PERSIST_METHODS = %i[create
                                     first_or_create find_or_create_by].freeze
@@ -72,9 +72,8 @@ module RuboCop
 
           add_offense(node, location: :selector,
                             message: format(CREATE_MSG,
-                                            "#{node.method_name}!",
-                                            node.method_name.to_s,
-                                            node.method_name.to_s))
+                                            prefer: "#{node.method_name}!",
+                                            current: node.method_name.to_s))
         end
 
         def on_send(node)
@@ -86,8 +85,8 @@ module RuboCop
 
           add_offense(node, location: :selector,
                             message: format(MSG,
-                                            "#{node.method_name}!",
-                                            node.method_name.to_s))
+                                            prefer: "#{node.method_name}!",
+                                            current: node.method_name.to_s))
         end
 
         def autocorrect(node)
@@ -123,7 +122,7 @@ module RuboCop
           unless MODIFY_PERSIST_METHODS.include?(node.method_name)
             add_offense(node, location: :selector,
                               message: format(CREATE_CONDITIONAL_MSG,
-                                              node.method_name.to_s))
+                                              method: node.method_name.to_s))
           end
 
           true

data/lib/rubocop/cop/rails/skips_model_validations.rb

@@ -24,7 +24,7 @@ module RuboCop
       #   user.update_attributes(website: 'example.com')
       #   FileUtils.touch('file')
       class SkipsModelValidations < Cop
-        MSG = 'Avoid using `%s` because it skips validations.'.freeze
+        MSG = 'Avoid using `%<method>s` because it skips validations.'.freeze
 
         METHODS_WITH_ARGUMENTS = %w[decrement!
                                     decrement_counter
@@ -58,7 +58,7 @@ module RuboCop
         private
 
         def message(node)
-          format(MSG, node.method_name)
+          format(MSG, method: node.method_name)
         end
 
         def blacklist

data/lib/rubocop/cop/rails/time_zone.rb

@@ -14,37 +14,55 @@ module RuboCop
       # When EnforcedStyle is 'flexible' then it's also allowed
       # to use Time.in_time_zone.
       #
-      # @example
-      #   # always offense
+      # @example EnforcedStyle: strict
+      #   # `strict` means that `Time` should be used with `zone`.
+      #
+      #   # bad
+      #   Time.now
+      #   Time.parse('2015-03-02 19:05:37')
+      #
+      #   # bad
+      #   Time.current
+      #   Time.at(timestamp).in_time_zone
+      #
+      #   # good
+      #   Time.zone.now
+      #   Time.zone.parse('2015-03-02 19:05:37')
+      #
+      # @example EnforcedStyle: flexible (default)
+      #   # `flexible` allows usage of `in_time_zone` instead of `zone`.
+      #
+      #   # bad
       #   Time.now
       #   Time.parse('2015-03-02 19:05:37')
       #
-      #   # no offense
+      #   # good
       #   Time.zone.now
       #   Time.zone.parse('2015-03-02 19:05:37')
       #
-      #   # no offense only if style is 'flexible'
+      #   # good
       #   Time.current
-      #   DateTime.strptime(str, "%Y-%m-%d %H:%M %Z").in_time_zone
       #   Time.at(timestamp).in_time_zone
       class TimeZone < Cop
         include ConfigurableEnforcedStyle
 
-        MSG = 'Do not use `%s` without zone. Use `%s` instead.'.freeze
+        MSG = 'Do not use `%<current>s` without zone. Use `%<prefer>s` ' \
+              'instead.'.freeze
 
-        MSG_ACCEPTABLE = 'Do not use `%s` without zone. ' \
-                         'Use one of %s instead.'.freeze
+        MSG_ACCEPTABLE = 'Do not use `%<current>s` without zone. ' \
+                         'Use one of %<prefer>s instead.'.freeze
 
         MSG_LOCALTIME = 'Do not use `Time.localtime` without ' \
                         'offset or zone.'.freeze
 
-        MSG_CURRENT = 'Do not use `%s`. Use `Time.zone.now` instead.'.freeze
+        MSG_CURRENT = 'Do not use `%<current>s`. Use `Time.zone.now` ' \
+                      'instead.'.freeze
 
         TIMECLASS = %i[Time DateTime].freeze
 
         GOOD_METHODS = %i[zone zone_default find_zone find_zone!].freeze
 
-        DANGEROUS_METHODS = %i[now local new strftime
+        DANGEROUS_METHODS = %i[now local new
                                parse at current].freeze
 
         ACCEPTED_METHODS = %i[in_time_zone utc getlocal
@@ -77,21 +95,25 @@ module RuboCop
           add_offense(node, location: :selector, message: message)
         end
 
+        # rubocop:disable Metrics/MethodLength
         def build_message(klass, method_name, node)
           if acceptable?
-            format(MSG_ACCEPTABLE,
-                   "#{klass}.#{method_name}",
-                   acceptable_methods(klass, method_name, node).join(', '))
+            format(
+              MSG_ACCEPTABLE,
+              current: "#{klass}.#{method_name}",
+              prefer: acceptable_methods(klass, method_name, node).join(', ')
+            )
           elsif method_name == 'current'
             format(MSG_CURRENT,
-                   "#{klass}.#{method_name}")
+                   current: "#{klass}.#{method_name}")
           else
             safe_method_name = safe_method(method_name, node)
             format(MSG,
-                   "#{klass}.#{method_name}",
-                   "Time.zone.#{safe_method_name}")
+                   current: "#{klass}.#{method_name}",
+                   prefer: "Time.zone.#{safe_method_name}")
           end
         end
+        # rubocop:enable Metrics/MethodLength
 
         def extract_method_chain(node)
           chain = []

data/lib/rubocop/cop/rails/uniq_before_pluck.rb

@@ -8,13 +8,6 @@ module RuboCop
       # The use of uniq before pluck is preferred because it executes within
       # the database.
       #
-      # @example
-      #   # bad
-      #   Model.pluck(:id).uniq
-      #
-      #   # good
-      #   Model.uniq.pluck(:id)
-      #
       # This cop has two different enforcement modes. When the EnforcedStyle
       # is conservative (the default) then only calls to pluck on a constant
       # (i.e. a model class) before uniq are added as offenses.
@@ -24,29 +17,45 @@ module RuboCop
       # cannot distinguish between calls to pluck on an ActiveRecord::Relation
       # vs a call to pluck on an ActiveRecord::Associations::CollectionProxy.
       #
-      # @example
+      # Autocorrect is disabled by default for this cop since it may generate
+      # false positives.
+      #
+      # @example EnforcedStyle: conservative (default)
+      #   # bad
+      #   Model.pluck(:id).uniq
+      #
+      #   # good
+      #   Model.uniq.pluck(:id)
+      #
+      # @example EnforcedStyle: aggressive
+      #   # bad
       #   # this will return a Relation that pluck is called on
       #   Model.where(cond: true).pluck(:id).uniq
       #
+      #   # bad
       #   # an association on an instance will return a CollectionProxy
       #   instance.assoc.pluck(:id).uniq
       #
-      # Autocorrect is disabled by default for this cop since it may generate
-      # false positives.
+      #   # bad
+      #   Model.pluck(:id).uniq
+      #
+      #   # good
+      #   Model.uniq.pluck(:id)
       #
       class UniqBeforePluck < RuboCop::Cop::Cop
         include ConfigurableEnforcedStyle
+        include RangeHelp
 
-        MSG = 'Use `%s` before `pluck`.'.freeze
+        MSG = 'Use `%<method>s` before `pluck`.'.freeze
         NEWLINE = "\n".freeze
-        PATTERN = '[!^block (send (send %s :pluck ...) ${:uniq :distinct} ...)]'
-                  .freeze
+        PATTERN = '[!^block (send (send %<type>s :pluck ...) ' \
+                  '${:uniq :distinct} ...)]'.freeze
 
         def_node_matcher :conservative_node_match,
-                         format(PATTERN, 'const')
+                         format(PATTERN, type: 'const')
 
         def_node_matcher :aggressive_node_match,
-                         format(PATTERN, '_')
+                         format(PATTERN, type: '_')
 
         def on_send(node)
           method = if style == :conservative
@@ -57,7 +66,8 @@ module RuboCop
 
           return unless method
 
-          add_offense(node, location: :selector, message: format(MSG, method))
+          add_offense(node, location: :selector,
+                            message: format(MSG, method: method))
         end
 
         def autocorrect(node)

data/lib/rubocop/cop/rails/validation.rb

@@ -4,8 +4,35 @@ module RuboCop
   module Cop
     module Rails
       # This cop checks for the use of old-style attribute validation macros.
+      #
+      # @example
+      #   # bad
+      #   validates_acceptance_of :foo
+      #   validates_confirmation_of :foo
+      #   validates_exclusion_of :foo
+      #   validates_format_of :foo
+      #   validates_inclusion_of :foo
+      #   validates_length_of :foo
+      #   validates_numericality_of :foo
+      #   validates_presence_of :foo
+      #   validates_size_of :foo
+      #   validates_uniqueness_of :foo
+      #
+      #   # good
+      #   validates :foo, acceptance: true
+      #   validates :foo, confirmation: true
+      #   validates :foo, exclusion: true
+      #   validates :foo, format: true
+      #   validates :foo, inclusion: true
+      #   validates :foo, length: true
+      #   validates :foo, numericality: true
+      #   validates :foo, presence: true
+      #   validates :foo, size: true
+      #   validates :foo, uniqueness: true
+      #
       class Validation < Cop
-        MSG = 'Prefer the new style validations `%s` over `%s`.'.freeze
+        MSG = 'Prefer the new style validations `%<prefer>s` over ' \
+              '`%<current>s`.'.freeze
 
         TYPES = %w[
           acceptance
@@ -39,7 +66,8 @@ module RuboCop
         private
 
         def message(node)
-          format(MSG, preferred_method(node.method_name), node.method_name)
+          format(MSG, prefer: preferred_method(node.method_name),
+                      current: node.method_name)
         end
 
         def preferred_method(method)

data/lib/rubocop/cop/security/open.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Security
+      # This cop checks for the use of `Kernel#open`.
+      # `Kernel#open` enables not only file access but also process invocation
+      # by prefixing a pipe symbol (e.g., `open("| ls")`).  So, it may lead to
+      # a serious security risk by using variable input to the argument of
+      # `Kernel#open`.  It would be better to use `File.open` or `IO.popen`
+      # explicitly.
+      #
+      # @example
+      #   # bad
+      #   open(something)
+      #
+      #   # good
+      #   File.open(something)
+      #   IO.popen(something)
+      class Open < Cop
+        MSG = 'The use of `Kernel#open` is a serious security risk.'.freeze
+
+        def_node_matcher :open?, <<-PATTERN
+          (send nil? :open $!str ...)
+        PATTERN
+
+        def safe?(node)
+          if node.str_type?
+            !node.str_content.empty? && !node.str_content.start_with?('|')
+          elsif node.dstr_type?
+            safe?(node.child_nodes.first)
+          elsif node.send_type? && node.method_name == :+
+            safe?(node.child_nodes.first)
+          else
+            false
+          end
+        end
+
+        def on_send(node)
+          open?(node) do |code|
+            return if safe?(code)
+            add_offense(node, location: :selector)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/style/and_or.rb

@@ -38,6 +38,7 @@ module RuboCop
       #   end
       class AndOr < Cop
         include ConfigurableEnforcedStyle
+        include RangeHelp
 
         MSG = 'Use `%<prefer>s` instead of `%<current>s`.'.freeze
 

data/lib/rubocop/cop/style/ascii_comments.rb

@@ -16,10 +16,12 @@ module RuboCop
       #   # good
       #   # Translates from English to Japanese
       class AsciiComments < Cop
+        include RangeHelp
+
         MSG = 'Use only ascii symbols in comments.'.freeze
 
         def investigate(processed_source)
-          processed_source.comments.each do |comment|
+          processed_source.each_comment do |comment|
             next if comment.text.ascii_only?
             next if only_allowed_non_ascii_chars?(comment.text)
             add_offense(comment, location: first_offense_range(comment))