rubocop 0.78.0 → 1.13.0

data/lib/rubocop/cop/security/eval.rb

@@ -11,9 +11,11 @@ module RuboCop
       #
       #   eval(something)
       #   binding.eval(something)
-      class Eval < Cop
+      class Eval < Base
         MSG = 'The use of `eval` is a serious security risk.'
+        RESTRICT_ON_SEND = %i[eval].freeze
 
+        # @!method eval?(node)
         def_node_matcher :eval?, <<~PATTERN
           (send {nil? (send nil? :binding)} :eval $!str ...)
         PATTERN
@@ -22,7 +24,7 @@ module RuboCop
           eval?(node) do |code|
             return if code.dstr_type? && code.recursive_literal?
 
-            add_offense(node, location: :selector)
+            add_offense(node.loc.selector)
           end
         end
       end

data/lib/rubocop/cop/security/json_load.rb

@@ -22,24 +22,24 @@ module RuboCop
       #   # good
       #   JSON.parse("{}")
       #
-      class JSONLoad < Cop
+      class JSONLoad < Base
+        extend AutoCorrector
+
         MSG = 'Prefer `JSON.parse` over `JSON.%<method>s`.'
+        RESTRICT_ON_SEND = %i[load restore].freeze
 
+        # @!method json_load(node)
         def_node_matcher :json_load, <<~PATTERN
           (send (const {nil? cbase} :JSON) ${:load :restore} ...)
         PATTERN
 
         def on_send(node)
           json_load(node) do |method|
-            add_offense(node,
-                        location: :selector,
-                        message: format(MSG, method: method))
+            add_offense(node.loc.selector, message: format(MSG, method: method)) do |corrector|
+              corrector.replace(node.loc.selector, 'parse')
+            end
           end
         end
-
-        def autocorrect(node)
-          ->(corrector) { corrector.replace(node.loc.selector, 'parse') }
-        end
       end
     end
   end

data/lib/rubocop/cop/security/marshal_load.rb

@@ -18,9 +18,11 @@ module RuboCop
       #   # okish - deep copy hack
       #   Marshal.load(Marshal.dump({}))
       #
-      class MarshalLoad < Cop
+      class MarshalLoad < Base
         MSG = 'Avoid using `Marshal.%<method>s`.'
+        RESTRICT_ON_SEND = %i[load restore].freeze
 
+        # @!method marshal_load(node)
         def_node_matcher :marshal_load, <<~PATTERN
           (send (const {nil? cbase} :Marshal) ${:load :restore}
           !(send (const {nil? cbase} :Marshal) :dump ...))
@@ -28,9 +30,7 @@ module RuboCop
 
         def on_send(node)
           marshal_load(node) do |method|
-            add_offense(node,
-                        location: :selector,
-                        message: format(MSG, method: method))
+            add_offense(node.loc.selector, message: format(MSG, method: method))
           end
         end
       end

data/lib/rubocop/cop/security/open.rb

@@ -3,34 +3,38 @@
 module RuboCop
   module Cop
     module Security
-      # This cop checks for the use of `Kernel#open`.
+      # This cop checks for the use of `Kernel#open` and `URI.open`.
       #
-      # `Kernel#open` enables not only file access but also process invocation
-      # by prefixing a pipe symbol (e.g., `open("| ls")`). So, it may lead to
-      # a serious security risk by using variable input to the argument of
-      # `Kernel#open`. It would be better to use `File.open`, `IO.popen` or
-      # `URI#open` explicitly.
+      # `Kernel#open` and `URI.open` enable not only file access but also process
+      # invocation by prefixing a pipe symbol (e.g., `open("| ls")`).
+      # So, it may lead to a serious security risk by using variable input to
+      # the argument of `Kernel#open` and `URI.open`. It would be better to use
+      # `File.open`, `IO.popen` or `URI.parse#open` explicitly.
       #
       # @example
       #   # bad
       #   open(something)
+      #   URI.open(something)
       #
       #   # good
       #   File.open(something)
       #   IO.popen(something)
       #   URI.parse(something).open
-      class Open < Cop
-        MSG = 'The use of `Kernel#open` is a serious security risk.'
+      class Open < Base
+        MSG = 'The use of `%<receiver>sopen` is a serious security risk.'
+        RESTRICT_ON_SEND = %i[open].freeze
 
+        # @!method open?(node)
         def_node_matcher :open?, <<~PATTERN
-          (send nil? :open $!str ...)
+          (send ${nil? (const {nil? cbase} :URI)} :open $!str ...)
         PATTERN
 
         def on_send(node)
-          open?(node) do |code|
+          open?(node) do |receiver, code|
             return if safe?(code)
 
-            add_offense(node, location: :selector)
+            message = format(MSG, receiver: receiver ? "#{receiver.source}." : 'Kernel#')
+            add_offense(node.loc.selector, message: message)
           end
         end
 

data/lib/rubocop/cop/security/yaml_load.rb

@@ -15,22 +15,24 @@ module RuboCop
       #   YAML.safe_load("--- foo")
       #   YAML.dump("foo")
       #
-      class YAMLLoad < Cop
+      class YAMLLoad < Base
+        extend AutoCorrector
+
         MSG = 'Prefer using `YAML.safe_load` over `YAML.load`.'
+        RESTRICT_ON_SEND = %i[load].freeze
 
+        # @!method yaml_load(node)
         def_node_matcher :yaml_load, <<~PATTERN
           (send (const {nil? cbase} :YAML) :load ...)
         PATTERN
 
         def on_send(node)
           yaml_load(node) do
-            add_offense(node, location: :selector)
+            add_offense(node.loc.selector) do |corrector|
+              corrector.replace(node.loc.selector, 'safe_load')
+            end
           end
         end
-
-        def autocorrect(node)
-          ->(corrector) { corrector.replace(node.loc.selector, 'safe_load') }
-        end
       end
     end
   end

data/lib/rubocop/cop/severity.rb

@@ -6,11 +6,10 @@ module RuboCop
     class Severity
       include Comparable
 
-      # @api private
-      NAMES = %i[refactor convention warning error fatal].freeze
+      NAMES = %i[info refactor convention warning error fatal].freeze
 
       # @api private
-      CODE_TABLE = { R: :refactor, C: :convention,
+      CODE_TABLE = { I: :info, R: :refactor, C: :convention,
                      W: :warning, E: :error, F: :fatal }.freeze
 
       # @api public
@@ -19,10 +18,9 @@ module RuboCop
       #
       # @return [Symbol]
       #   severity.
-      #   any of `:refactor`, `:convention`, `:warning`, `:error` or `:fatal`.
+      #   any of `:info`, `:refactor`, `:convention`, `:warning`, `:error` or `:fatal`.
       attr_reader :name
 
-      # @api private
       def self.name_from_code(code)
         name = code.to_sym
         CODE_TABLE[name] || name
@@ -31,30 +29,24 @@ module RuboCop
       # @api private
       def initialize(name_or_code)
         name = Severity.name_from_code(name_or_code)
-        unless NAMES.include?(name)
-          raise ArgumentError, "Unknown severity: #{name}"
-        end
+        raise ArgumentError, "Unknown severity: #{name}" unless NAMES.include?(name)
 
         @name = name.freeze
         freeze
       end
 
-      # @api private
       def to_s
         @name.to_s
       end
 
-      # @api private
       def code
         @name.to_s[0].upcase
       end
 
-      # @api private
       def level
         NAMES.index(name) + 1
       end
 
-      # @api private
       def ==(other)
         @name == if other.is_a?(Symbol)
                    other
@@ -63,12 +55,10 @@ module RuboCop
                  end
       end
 
-      # @api private
       def hash
         @name.hash
       end
 
-      # @api private
       def <=>(other)
         level <=> other.level
       end

data/lib/rubocop/cop/style/access_modifier_declarations.rb

@@ -5,11 +5,12 @@ module RuboCop
     module Style
       # Access modifiers should be declared to apply to a group of methods
       # or inline before each method, depending on configuration.
+      # EnforcedStyle config covers only method definitions.
+      # Applications of visibility methods to symbols can be controlled
+      # using AllowModifiersOnSymbols config.
       #
       # @example EnforcedStyle: group (default)
-      #
       #   # bad
-      #
       #   class Foo
       #
       #     private def bar; end
@@ -18,7 +19,6 @@ module RuboCop
       #   end
       #
       #   # good
-      #
       #   class Foo
       #
       #     private
@@ -27,10 +27,9 @@ module RuboCop
       #     def baz; end
       #
       #   end
-      # @example EnforcedStyle: inline
       #
+      # @example EnforcedStyle: inline
       #   # bad
-      #
       #   class Foo
       #
       #     private
@@ -41,14 +40,29 @@ module RuboCop
       #   end
       #
       #   # good
-      #
       #   class Foo
       #
       #     private def bar; end
       #     private def baz; end
       #
       #   end
-      class AccessModifierDeclarations < Cop
+      #
+      # @example AllowModifiersOnSymbols: true (default)
+      #   # good
+      #   class Foo
+      #
+      #     private :bar, :baz
+      #
+      #   end
+      #
+      # @example AllowModifiersOnSymbols: false
+      #   # bad
+      #   class Foo
+      #
+      #     private :bar, :baz
+      #
+      #   end
+      class AccessModifierDeclarations < Base
         include ConfigurableEnforcedStyle
 
         GROUP_STYLE_MESSAGE = [
@@ -61,14 +75,20 @@ module RuboCop
           'inlined in method definitions.'
         ].join(' ')
 
+        RESTRICT_ON_SEND = %i[private protected public module_function].freeze
+
+        # @!method access_modifier_with_symbol?(node)
+        def_node_matcher :access_modifier_with_symbol?, <<~PATTERN
+          (send nil? {:private :protected :public :module_function} (sym _))
+        PATTERN
+
         def on_send(node)
           return unless node.access_modifier?
-          return if node.parent.pair_type?
+          return if node.parent&.pair_type?
+          return if allow_modifiers_on_symbols?(node)
 
           if offense?(node)
-            add_offense(node, location: :selector) do
-              opposite_style_detected
-            end
+            add_offense(node.loc.selector) { opposite_style_detected }
           else
             correct_style_detected
           end
@@ -76,6 +96,10 @@ module RuboCop
 
         private
 
+        def allow_modifiers_on_symbols?(node)
+          cop_config['AllowModifiersOnSymbols'] && access_modifier_with_symbol?(node)
+        end
+
         def offense?(node)
           (group_style? && access_modifier_is_inlined?(node)) ||
             (inline_style? && access_modifier_is_not_inlined?(node))
@@ -97,8 +121,8 @@ module RuboCop
           !access_modifier_is_inlined?(node)
         end
 
-        def message(node)
-          access_modifier = node.loc.selector.source
+        def message(range)
+          access_modifier = range.source
 
           if group_style?
             format(GROUP_STYLE_MESSAGE, access_modifier: access_modifier)

data/lib/rubocop/cop/style/accessor_grouping.rb

@@ -0,0 +1,150 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Style
+      # This cop checks for grouping of accessors in `class` and `module` bodies.
+      # By default it enforces accessors to be placed in grouped declarations,
+      # but it can be configured to enforce separating them in multiple declarations.
+      #
+      # NOTE: `Sorbet` is not compatible with "grouped" style. Consider "separated" style
+      # or disabling this cop.
+      #
+      # @example EnforcedStyle: grouped (default)
+      #   # bad
+      #   class Foo
+      #     attr_reader :bar
+      #     attr_reader :baz
+      #   end
+      #
+      #   # good
+      #   class Foo
+      #     attr_reader :bar, :baz
+      #   end
+      #
+      # @example EnforcedStyle: separated
+      #   # bad
+      #   class Foo
+      #     attr_reader :bar, :baz
+      #   end
+      #
+      #   # good
+      #   class Foo
+      #     attr_reader :bar
+      #     attr_reader :baz
+      #   end
+      #
+      class AccessorGrouping < Base
+        include ConfigurableEnforcedStyle
+        include RangeHelp
+        include VisibilityHelp
+        extend AutoCorrector
+
+        GROUPED_MSG = 'Group together all `%<accessor>s` attributes.'
+        SEPARATED_MSG = 'Use one attribute per `%<accessor>s`.'
+
+        ACCESSOR_METHODS = %i[attr_reader attr_writer attr_accessor attr].freeze
+
+        def on_class(node)
+          class_send_elements(node).each do |macro|
+            next unless accessor?(macro)
+
+            check(macro)
+          end
+        end
+        alias on_sclass on_class
+        alias on_module on_class
+
+        private
+
+        def check(send_node)
+          return if previous_line_comment?(send_node)
+          return unless grouped_style? && sibling_accessors(send_node).size > 1 ||
+                        separated_style? && send_node.arguments.size > 1
+
+          message = message(send_node)
+          add_offense(send_node, message: message) do |corrector|
+            autocorrect(corrector, send_node)
+          end
+        end
+
+        def autocorrect(corrector, node)
+          if (preferred_accessors = preferred_accessors(node))
+            corrector.replace(node, preferred_accessors)
+          else
+            range = range_with_surrounding_space(range: node.loc.expression, side: :left)
+            corrector.remove(range)
+          end
+        end
+
+        def previous_line_comment?(node)
+          comment_line?(processed_source[node.first_line - 2])
+        end
+
+        def class_send_elements(class_node)
+          class_def = class_node.body
+
+          if !class_def || class_def.def_type?
+            []
+          elsif class_def.send_type?
+            [class_def]
+          else
+            class_def.each_child_node(:send).to_a
+          end
+        end
+
+        def accessor?(send_node)
+          send_node.macro? && ACCESSOR_METHODS.include?(send_node.method_name)
+        end
+
+        def grouped_style?
+          style == :grouped
+        end
+
+        def separated_style?
+          style == :separated
+        end
+
+        def sibling_accessors(send_node)
+          send_node.parent.each_child_node(:send).select do |sibling|
+            accessor?(sibling) &&
+              sibling.method?(send_node.method_name) &&
+              node_visibility(sibling) == node_visibility(send_node) &&
+              !previous_line_comment?(sibling)
+          end
+        end
+
+        def message(send_node)
+          msg = grouped_style? ? GROUPED_MSG : SEPARATED_MSG
+          format(msg, accessor: send_node.method_name)
+        end
+
+        def preferred_accessors(node)
+          if grouped_style?
+            accessors = sibling_accessors(node)
+            group_accessors(node, accessors) if node == accessors.first
+          else
+            separate_accessors(node)
+          end
+        end
+
+        def group_accessors(node, accessors)
+          accessor_names = accessors.flat_map { |accessor| accessor.arguments.map(&:source) }
+
+          "#{node.method_name} #{accessor_names.join(', ')}"
+        end
+
+        def separate_accessors(node)
+          node.arguments.map do |arg|
+            if arg == node.arguments.first
+              "#{node.method_name} #{arg.source}"
+            else
+              indent = ' ' * node.loc.column
+              "#{indent}#{node.method_name} #{arg.source}"
+            end
+          end.join("\n")
+        end
+      end
+    end
+  end
+end