rubocop 1.19.0 → 1.40.0

data/lib/rubocop/cop/security/open.rb

@@ -3,7 +3,8 @@
 module RuboCop
   module Cop
     module Security
-      # This cop checks for the use of `Kernel#open` and `URI.open`.
+      # Checks for the use of `Kernel#open` and `URI.open` with dynamic
+      # data.
       #
       # `Kernel#open` and `URI.open` enable not only file access but also process
       # invocation by prefixing a pipe symbol (e.g., `open("| ls")`).
@@ -11,15 +12,28 @@ module RuboCop
       # the argument of `Kernel#open` and `URI.open`. It would be better to use
       # `File.open`, `IO.popen` or `URI.parse#open` explicitly.
       #
+      # NOTE: `open` and `URI.open` with literal strings are not flagged by this
+      # cop.
+      #
+      # @safety
+      #   This cop could register false positives if `open` is redefined
+      #   in a class and then used without a receiver in that class.
+      #
       # @example
       #   # bad
       #   open(something)
+      #   open("| #{something}")
       #   URI.open(something)
       #
       #   # good
       #   File.open(something)
       #   IO.popen(something)
       #   URI.parse(something).open
+      #
+      #   # good (literal strings)
+      #   open("foo.text")
+      #   open("| foo")
+      #   URI.open("http://example.com")
       class Open < Base
         MSG = 'The use of `%<receiver>sopen` is a serious security risk.'
         RESTRICT_ON_SEND = %i[open].freeze

data/lib/rubocop/cop/security/yaml_load.rb

@@ -3,17 +3,25 @@
 module RuboCop
   module Cop
     module Security
-      # This cop checks for the use of YAML class methods which have
+      # Checks for the use of YAML class methods which have
       # potential security issues leading to remote code execution when
       # loading from an untrusted source.
       #
+      # NOTE: Ruby 3.1+ (Psych 4) uses `Psych.load` as `Psych.safe_load` by default.
+      #
+      # @safety
+      #   The behavior of the code might change depending on what was
+      #   in the YAML payload, since `YAML.safe_load` is more restrictive.
+      #
       # @example
       #   # bad
-      #   YAML.load("--- foo")
+      #   YAML.load("--- !ruby/object:Foo {}") # Psych 3 is unsafe by default
       #
       #   # good
-      #   YAML.safe_load("--- foo")
-      #   YAML.dump("foo")
+      #   YAML.safe_load("--- !ruby/object:Foo {}", [Foo])                    # Ruby 2.5  (Psych 3)
+      #   YAML.safe_load("--- !ruby/object:Foo {}", permitted_classes: [Foo]) # Ruby 3.0- (Psych 3)
+      #   YAML.load("--- !ruby/object:Foo {}", permitted_classes: [Foo])      # Ruby 3.1+ (Psych 4)
+      #   YAML.dump(foo)
       #
       class YAMLLoad < Base
         extend AutoCorrector
@@ -27,6 +35,8 @@ module RuboCop
         PATTERN
 
         def on_send(node)
+          return if target_ruby_version >= 3.1
+
           yaml_load(node) do
             add_offense(node.loc.selector) do |corrector|
               corrector.replace(node.loc.selector, 'safe_load')

data/lib/rubocop/cop/style/access_modifier_declarations.rb

@@ -9,6 +9,11 @@ module RuboCop
       # Applications of visibility methods to symbols can be controlled
       # using AllowModifiersOnSymbols config.
       #
+      # @safety
+      #   Autocorrection is not safe, because the visibility of dynamically
+      #   defined methods can vary depending on the state determined by
+      #   the group access modifier.
+      #
       # @example EnforcedStyle: group (default)
       #   # bad
       #   class Foo
@@ -63,7 +68,10 @@ module RuboCop
       #
       #   end
       class AccessModifierDeclarations < Base
+        extend AutoCorrector
+
         include ConfigurableEnforcedStyle
+        include RangeHelp
 
         GROUP_STYLE_MESSAGE = [
           '`%<access_modifier>s` should not be',
@@ -77,6 +85,8 @@ module RuboCop
 
         RESTRICT_ON_SEND = %i[private protected public module_function].freeze
 
+        ALLOWED_NODE_TYPES = %i[pair block].freeze
+
         # @!method access_modifier_with_symbol?(node)
         def_node_matcher :access_modifier_with_symbol?, <<~PATTERN
           (send nil? {:private :protected :public :module_function} (sym _))
@@ -84,11 +94,14 @@ module RuboCop
 
         def on_send(node)
           return unless node.access_modifier?
-          return if node.parent&.pair_type?
+          return if ALLOWED_NODE_TYPES.include?(node.parent&.type)
           return if allow_modifiers_on_symbols?(node)
 
           if offense?(node)
-            add_offense(node.loc.selector) { opposite_style_detected }
+            add_offense(node.loc.selector) do |corrector|
+              autocorrect(corrector, node)
+            end
+            opposite_style_detected
           else
             correct_style_detected
           end
@@ -96,6 +109,23 @@ module RuboCop
 
         private
 
+        def autocorrect(corrector, node)
+          case style
+          when :group
+            def_node = find_corresponding_def_node(node)
+            return unless def_node
+
+            remove_node(corrector, def_node)
+            remove_node(corrector, node)
+            insert_def(corrector, node, def_node.source)
+          when :inline
+            remove_node(corrector, node)
+            select_grouped_def_nodes(node).each do |grouped_def_node|
+              insert_inline_modifier(corrector, grouped_def_node, node.method_name)
+            end
+          end
+        end
+
         def allow_modifiers_on_symbols?(node)
           cop_config['AllowModifiersOnSymbols'] && access_modifier_with_symbol?(node)
         end
@@ -130,6 +160,50 @@ module RuboCop
             format(INLINE_STYLE_MESSAGE, access_modifier: access_modifier)
           end
         end
+
+        def find_corresponding_def_node(node)
+          if access_modifier_with_symbol?(node)
+            method_name = node.arguments.first.value
+            node.parent.each_child_node(:def).find do |child|
+              child.method?(method_name)
+            end
+          else
+            node.arguments.first
+          end
+        end
+
+        def find_argument_less_modifier_node(node)
+          node.parent.each_child_node(:send).find do |child|
+            child.method?(node.method_name) && child.arguments.empty?
+          end
+        end
+
+        def select_grouped_def_nodes(node)
+          node.right_siblings.take_while do |sibling|
+            !(sibling.send_type? && sibling.bare_access_modifier_declaration?)
+          end.select(&:def_type?)
+        end
+
+        def insert_def(corrector, node, source)
+          source = [*processed_source.ast_with_comments[node].map(&:text), source].join("\n")
+          argument_less_modifier_node = find_argument_less_modifier_node(node)
+          if argument_less_modifier_node
+            corrector.insert_after(argument_less_modifier_node, "\n\n#{source}")
+          else
+            corrector.insert_before(
+              node.each_ancestor(:block, :class, :module).first.location.end,
+              "#{node.method_name}\n\n#{source}\n"
+            )
+          end
+        end
+
+        def insert_inline_modifier(corrector, node, modifier_name)
+          corrector.insert_before(node, "#{modifier_name} ")
+        end
+
+        def remove_node(corrector, node)
+          corrector.remove(range_with_comments_and_lines(node))
+        end
       end
     end
   end

data/lib/rubocop/cop/style/accessor_grouping.rb

@@ -3,7 +3,7 @@
 module RuboCop
   module Cop
     module Style
-      # This cop checks for grouping of accessors in `class` and `module` bodies.
+      # Checks for grouping of accessors in `class` and `module` bodies.
       # By default it enforces accessors to be placed in grouped declarations,
       # but it can be configured to enforce separating them in multiple declarations.
       #
@@ -59,8 +59,8 @@ module RuboCop
 
         def check(send_node)
           return if previous_line_comment?(send_node)
-          return unless grouped_style? && sibling_accessors(send_node).size > 1 ||
-                        separated_style? && send_node.arguments.size > 1
+          return unless (grouped_style? && sibling_accessors(send_node).size > 1) ||
+                        (separated_style? && send_node.arguments.size > 1)
 
           message = message(send_node)
           add_offense(send_node, message: message) do |corrector|
@@ -72,7 +72,7 @@ module RuboCop
           if (preferred_accessors = preferred_accessors(node))
             corrector.replace(node, preferred_accessors)
           else
-            range = range_with_surrounding_space(range: node.loc.expression, side: :left)
+            range = range_with_surrounding_space(node.loc.expression, side: :left)
             corrector.remove(range)
           end
         end
@@ -122,25 +122,29 @@ module RuboCop
         def preferred_accessors(node)
           if grouped_style?
             accessors = sibling_accessors(node)
-            group_accessors(node, accessors) if node == accessors.first
+            group_accessors(node, accessors) if node.loc == accessors.first.loc
           else
             separate_accessors(node)
           end
         end
 
         def group_accessors(node, accessors)
-          accessor_names = accessors.flat_map { |accessor| accessor.arguments.map(&:source) }
+          accessor_names = accessors.flat_map { |accessor| accessor.arguments.map(&:source) }.uniq
 
           "#{node.method_name} #{accessor_names.join(', ')}"
         end
 
         def separate_accessors(node)
-          node.arguments.map do |arg|
-            if arg == node.arguments.first
+          node.arguments.flat_map do |arg|
+            lines = [
+              *processed_source.ast_with_comments[arg].map(&:text),
               "#{node.method_name} #{arg.source}"
+            ]
+            if arg == node.arguments.first
+              lines
             else
               indent = ' ' * node.loc.column
-              "#{indent}#{node.method_name} #{arg.source}"
+              lines.map { |line| "#{indent}#{line}" }
             end
           end.join("\n")
         end

data/lib/rubocop/cop/style/alias.rb

@@ -3,7 +3,7 @@
 module RuboCop
   module Cop
     module Style
-      # This cop enforces the use of either `#alias` or `#alias_method`
+      # Enforces the use of either `#alias` or `#alias_method`
       # depending on configuration.
       # It also flags uses of `alias :symbol` rather than `alias bareword`.
       #
@@ -76,7 +76,7 @@ module RuboCop
 
         def add_offense_for_args(node, &block)
           existing_args  = node.children.map(&:source).join(' ')
-          preferred_args = node.children.map { |a| a.source[1..-1] }.join(' ')
+          preferred_args = node.children.map { |a| a.source[1..] }.join(' ')
           arg_ranges     = node.children.map(&:source_range)
           msg            = format(MSG_SYMBOL_ARGS, prefer: preferred_args, current: existing_args)
           add_offense(arg_ranges.reduce(&:join), message: msg, &block)
@@ -134,8 +134,8 @@ module RuboCop
         end
 
         def correct_alias_with_symbol_args(corrector, node)
-          corrector.replace(node.new_identifier, node.new_identifier.source[1..-1])
-          corrector.replace(node.old_identifier, node.old_identifier.source[1..-1])
+          corrector.replace(node.new_identifier, node.new_identifier.source[1..])
+          corrector.replace(node.old_identifier, node.old_identifier.source[1..])
         end
 
         # @!method identifier(node)

data/lib/rubocop/cop/style/and_or.rb

@@ -3,14 +3,16 @@
 module RuboCop
   module Cop
     module Style
-      # This cop checks for uses of `and` and `or`, and suggests using `&&` and
+      # Checks for uses of `and` and `or`, and suggests using `&&` and
       # `||` instead. It can be configured to check only in conditions or in
       # all contexts.
       #
-      # @example EnforcedStyle: always
-      #   # bad
-      #   foo.save and return
+      # @safety
+      #   Autocorrection is unsafe because there is a different operator precedence
+      #   between logical operators (`&&` and `||`) and semantic operators (`and` and `or`),
+      #   and that might change the behavior.
       #
+      # @example EnforcedStyle: conditionals (default)
       #   # bad
       #   if foo and bar
       #   end
@@ -19,10 +21,16 @@ module RuboCop
       #   foo.save && return
       #
       #   # good
+      #   foo.save and return
+      #
+      #   # good
       #   if foo && bar
       #   end
       #
-      # @example EnforcedStyle: conditionals (default)
+      # @example EnforcedStyle: always
+      #   # bad
+      #   foo.save and return
+      #
       #   # bad
       #   if foo and bar
       #   end
@@ -31,9 +39,6 @@ module RuboCop
       #   foo.save && return
       #
       #   # good
-      #   foo.save and return
-      #
-      #   # good
       #   if foo && bar
       #   end
       class AndOr < Base
@@ -106,7 +111,7 @@ module RuboCop
         end
 
         # ! is a special case:
-        # 'x and !obj.method arg' can be auto-corrected if we
+        # 'x and !obj.method arg' can be autocorrected if we
         # recurse down a level and add parens to 'obj.method arg'
         # however, 'not x' also parses as (send x :!)
         def correct_not(node, receiver, corrector)

data/lib/rubocop/cop/style/arguments_forwarding.rb

@@ -30,6 +30,10 @@ module RuboCop
       #     bar(*args)
       #   end
       #
+      #   def foo(**kwargs)
+      #     bar(**kwargs)
+      #   end
+      #
       # @example AllowOnlyRestArgument: false
       #   # bad
       #   # The following code can replace the arguments with `...`,
@@ -38,6 +42,10 @@ module RuboCop
       #     bar(*args)
       #   end
       #
+      #   def foo(**kwargs)
+      #     bar(**kwargs)
+      #   end
+      #
       class ArgumentsForwarding < Base
         include RangeHelp
         extend AutoCorrector
@@ -49,12 +57,15 @@ module RuboCop
 
         # @!method use_rest_arguments?(node)
         def_node_matcher :use_rest_arguments?, <<~PATTERN
-          (args (restarg $_) $...)
+          (args ({restarg kwrestarg} $_) $...)
         PATTERN
 
         # @!method only_rest_arguments?(node, name)
         def_node_matcher :only_rest_arguments?, <<~PATTERN
-          (send _ _ (splat (lvar %1)))
+          {
+            (send _ _ (splat (lvar %1)))
+            (send _ _ (hash (kwsplat (lvar %1))))
+          }
         PATTERN
 
         # @!method forwarding_method_arguments?(node, rest_name, block_name, kwargs_name)
@@ -62,11 +73,11 @@ module RuboCop
           {
             (send _ _
               (splat (lvar %1))
-              (block-pass (lvar %2)))
+              (block-pass {(lvar %2) nil?}))
             (send _ _
               (splat (lvar %1))
               (hash (kwsplat (lvar %3)))
-              (block-pass (lvar %2)))
+              (block-pass {(lvar %2) nil?}))
           }
         PATTERN
 
@@ -122,7 +133,7 @@ module RuboCop
         def register_offense_to_method_definition_arguments(method_definition)
           add_offense(arguments_range(method_definition)) do |corrector|
             arguments_range = range_with_surrounding_space(
-              range: method_definition.arguments.source_range, side: :left
+              method_definition.arguments.source_range, side: :left
             )
             corrector.replace(arguments_range, '(...)')
           end

data/lib/rubocop/cop/style/array_coercion.rb

@@ -3,11 +3,29 @@
 module RuboCop
   module Cop
     module Style
-      # This cop enforces the use of `Array()` instead of explicit `Array` check or `[*var]`.
+      # Enforces the use of `Array()` instead of explicit `Array` check or `[*var]`.
       #
-      # This cop is disabled by default because false positive will occur if
-      # the argument of `Array()` is not an array (e.g. Hash, Set),
-      # an array will be returned as an incompatibility result.
+      # The cop is disabled by default due to safety concerns.
+      #
+      # @safety
+      #   This cop is unsafe because a false positive may occur if
+      #   the argument of `Array()` is (or could be) nil or depending
+      #   on how the argument is handled by `Array()` (which can be
+      #   different than just wrapping the argument in an array).
+      #
+      #   For example:
+      #
+      #   [source,ruby]
+      #   ----
+      #   [nil]             #=> [nil]
+      #   Array(nil)        #=> []
+      #
+      #   [{a: 'b'}]        #= [{a: 'b'}]
+      #   Array({a: 'b'})   #=> [[:a, 'b']]
+      #
+      #   [Time.now]        #=> [#<Time ...>]
+      #   Array(Time.now)   #=> [14, 16, 14, 16, 9, 2021, 4, 259, true, "EDT"]
+      #   ----
       #
       # @example
       #   # bad

data/lib/rubocop/cop/style/array_intersect.rb

@@ -0,0 +1,111 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Style
+      # In Ruby 3.1, `Array#intersect?` has been added.
+      #
+      # This cop identifies places where `(array1 & array2).any?`
+      # can be replaced by `array1.intersect?(array2)`.
+      #
+      # The `array1.intersect?(array2)` method is faster than
+      # `(array1 & array2).any?` and is more readable.
+      #
+      # @safety
+      #   This cop cannot guarantee that array1 and array2 are
+      #   actually arrays while method `intersect?` is for arrays only.
+      #
+      # @example
+      #   # bad
+      #   (array1 & array2).any?
+      #   (array1 & array2).empty?
+      #
+      #   # good
+      #   array1.intersect?(array2)
+      #   !array1.intersect?(array2)
+      #
+      # @example AllCops:ActiveSupportExtensionsEnabled: false (default)
+      #   # good
+      #   (array1 & array2).present?
+      #   (array1 & array2).blank?
+      #
+      # @example AllCops:ActiveSupportExtensionsEnabled: true
+      #   # bad
+      #   (array1 & array2).present?
+      #   (array1 & array2).blank?
+      #
+      #   # good
+      #   array1.intersect?(array2)
+      #   !array1.intersect?(array2)
+      class ArrayIntersect < Base
+        extend AutoCorrector
+        extend TargetRubyVersion
+
+        minimum_target_ruby_version 3.1
+
+        # @!method regular_bad_intersection_check?(node)
+        def_node_matcher :regular_bad_intersection_check?, <<~PATTERN
+          (send
+            (begin
+              (send $(...) :& $(...))
+            ) ${:any? :empty?}
+          )
+        PATTERN
+
+        # @!method active_support_bad_intersection_check?(node)
+        def_node_matcher :active_support_bad_intersection_check?, <<~PATTERN
+          (send
+            (begin
+              (send $(...) :& $(...))
+            ) ${:present? :any? :blank? :empty?}
+          )
+        PATTERN
+
+        MSG = 'Use `%<negated>s%<receiver>s.intersect?(%<argument>s)` ' \
+              'instead of `(%<receiver>s & %<argument>s).%<method_name>s`.'
+        STRAIGHT_METHODS = %i[present? any?].freeze
+        NEGATED_METHODS = %i[blank? empty?].freeze
+        RESTRICT_ON_SEND = (STRAIGHT_METHODS + NEGATED_METHODS).freeze
+
+        def on_send(node)
+          return unless (receiver, argument, method_name = bad_intersection_check?(node))
+
+          message = message(receiver.source, argument.source, method_name)
+
+          add_offense(node, message: message) do |corrector|
+            if straight?(method_name)
+              corrector.replace(node, "#{receiver.source}.intersect?(#{argument.source})")
+            else
+              corrector.replace(node, "!#{receiver.source}.intersect?(#{argument.source})")
+            end
+          end
+        end
+
+        private
+
+        def bad_intersection_check?(node)
+          if active_support_extensions_enabled?
+            active_support_bad_intersection_check?(node)
+          else
+            regular_bad_intersection_check?(node)
+          end
+        end
+
+        def straight?(method_name)
+          STRAIGHT_METHODS.include?(method_name.to_sym)
+        end
+
+        def message(receiver, argument, method_name)
+          negated = straight?(method_name) ? '' : '!'
+          format(
+            MSG,
+            negated: negated,
+            receiver: receiver,
+            argument: argument,
+            method_name: method_name
+          )
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/style/array_join.rb

@@ -3,7 +3,7 @@
 module RuboCop
   module Cop
     module Style
-      # This cop checks for uses of "*" as a substitute for _join_.
+      # Checks for uses of "*" as a substitute for _join_.
       #
       # Not all cases can reliably checked, due to Ruby's dynamic
       # types, so we consider only cases when the first argument is an

data/lib/rubocop/cop/style/ascii_comments.rb

@@ -1,11 +1,9 @@
 # frozen_string_literal: true
 
-# rubocop:disable Style/AsciiComments
-
 module RuboCop
   module Cop
     module Style
-      # This cop checks for non-ascii (non-English) characters
+      # Checks for non-ascii (non-English) characters
       # in comments. You could set an array of allowed non-ascii chars in
       # `AllowedChars` attribute (copyright notice "©" by default).
       #
@@ -57,4 +55,3 @@ module RuboCop
     end
   end
 end
-# rubocop:enable Style/AsciiComments

data/lib/rubocop/cop/style/attr.rb

@@ -3,7 +3,7 @@
 module RuboCop
   module Cop
     module Style
-      # This cop checks for uses of Module#attr.
+      # Checks for uses of Module#attr.
       #
       # @example
       #   # bad - creates a single attribute accessor (deprecated in Ruby 1.9)

data/lib/rubocop/cop/style/auto_resource_cleanup.rb

@@ -3,7 +3,7 @@
 module RuboCop
   module Cop
     module Style
-      # This cop checks for cases when you could use a block
+      # Checks for cases when you could use a block
       # accepting version of a method that does automatic
       # resource cleanup.
       #

data/lib/rubocop/cop/style/bare_percent_literals.rb

@@ -3,7 +3,7 @@
 module RuboCop
   module Cop
     module Style
-      # This cop checks if usage of %() or %Q() matches configuration.
+      # Checks if usage of %() or %Q() matches configuration.
       #
       # @example EnforcedStyle: bare_percent (default)
       #   # bad

data/lib/rubocop/cop/style/bisected_attr_accessor/macro.rb

@@ -18,7 +18,7 @@ module RuboCop
 
           def initialize(node)
             @node = node
-            @attrs = node.arguments.map { |attr| [attr.source, attr] }.to_h
+            @attrs = node.arguments.to_h { |attr| [attr.source, attr] }
             @bisection = []
           end
 

data/lib/rubocop/cop/style/bisected_attr_accessor.rb

@@ -3,7 +3,7 @@
 module RuboCop
   module Cop
     module Style
-      # This cop checks for places where `attr_reader` and `attr_writer`
+      # Checks for places where `attr_reader` and `attr_writer`
       # for the same method can be combined into single `attr_accessor`.
       #
       # @example

data/lib/rubocop/cop/style/block_comments.rb

@@ -3,7 +3,7 @@
 module RuboCop
   module Cop
     module Style
-      # This cop looks for uses of block comments (=begin...=end).
+      # Looks for uses of block comments (=begin...=end).
       #
       # @example
       #   # bad