rubocop 1.24.1 → 1.64.1

data/lib/rubocop/cop/security/compound_hash.rb

@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Security
+      # Checks for implementations of the `hash` method which combine
+      # values using custom logic instead of delegating to `Array#hash`.
+      #
+      # Manually combining hashes is error prone and hard to follow, especially
+      # when there are many values. Poor implementations may also introduce
+      # performance or security concerns if they are prone to collisions.
+      # Delegating to `Array#hash` is clearer and safer, although it might be slower
+      # depending on the use case.
+      #
+      # @safety
+      #   This cop may be unsafe if the application logic depends on the hash
+      #   value, however this is inadvisable anyway.
+      #
+      # @example
+      #
+      #   # bad
+      #   def hash
+      #     @foo ^ @bar
+      #   end
+      #
+      #   # good
+      #   def hash
+      #     [@foo, @bar].hash
+      #   end
+      class CompoundHash < Base
+        COMBINATOR_IN_HASH_MSG = 'Use `[...].hash` instead of combining hash values manually.'
+        MONUPLE_HASH_MSG =
+          'Delegate hash directly without wrapping in an array when only using a single value.'
+        REDUNDANT_HASH_MSG = 'Calling .hash on elements of a hashed array is redundant.'
+
+        # @!method hash_method_definition?(node)
+        def_node_matcher :hash_method_definition?, <<~PATTERN
+          {#static_hash_method_definition? | #dynamic_hash_method_definition?}
+        PATTERN
+
+        # @!method dynamic_hash_method_definition?(node)
+        def_node_matcher :dynamic_hash_method_definition?, <<~PATTERN
+          (block
+            (send _ {:define_method | :define_singleton_method}
+              (sym :hash))
+            (args)
+            _)
+        PATTERN
+
+        # @!method static_hash_method_definition?(node)
+        def_node_matcher :static_hash_method_definition?, <<~PATTERN
+          ({def | defs _} :hash
+            (args)
+            _)
+        PATTERN
+
+        # @!method bad_hash_combinator?(node)
+        def_node_matcher :bad_hash_combinator?, <<~PATTERN
+          ({send | op-asgn} _ {:^ | :+ | :* | :|} _)
+        PATTERN
+
+        # @!method monuple_hash?(node)
+        def_node_matcher :monuple_hash?, <<~PATTERN
+          (send (array _) :hash)
+        PATTERN
+
+        # @!method redundant_hash?(node)
+        def_node_matcher :redundant_hash?, <<~PATTERN
+          (
+            ^^(send array ... :hash)
+            _ :hash
+          )
+        PATTERN
+
+        def contained_in_hash_method?(node, &block)
+          node.each_ancestor.any? do |ancestor|
+            hash_method_definition?(ancestor, &block)
+          end
+        end
+
+        def outer_bad_hash_combinator?(node)
+          bad_hash_combinator?(node) do
+            yield true if node.each_ancestor.none? { |ancestor| bad_hash_combinator?(ancestor) }
+          end
+        end
+
+        def on_send(node)
+          outer_bad_hash_combinator?(node) do
+            contained_in_hash_method?(node) do
+              add_offense(node, message: COMBINATOR_IN_HASH_MSG)
+            end
+          end
+
+          monuple_hash?(node) do
+            add_offense(node, message: MONUPLE_HASH_MSG)
+          end
+
+          redundant_hash?(node) do
+            add_offense(node, message: REDUNDANT_HASH_MSG)
+          end
+        end
+        alias on_op_asgn on_send
+      end
+    end
+  end
+end

data/lib/rubocop/cop/security/eval.rb

@@ -3,7 +3,7 @@
 module RuboCop
   module Cop
     module Security
-      # This cop checks for the use of `Kernel#eval` and `Binding#eval`.
+      # Checks for the use of `Kernel#eval` and `Binding#eval`.
       #
       # @example
       #

data/lib/rubocop/cop/security/json_load.rb

@@ -3,7 +3,7 @@
 module RuboCop
   module Cop
     module Security
-      # This cop checks for the use of JSON class methods which have potential
+      # Checks for the use of JSON class methods which have potential
       # security issues.
       #
       # @safety

data/lib/rubocop/cop/security/marshal_load.rb

@@ -3,7 +3,7 @@
 module RuboCop
   module Cop
     module Security
-      # This cop checks for the use of Marshal class methods which have
+      # Checks for the use of Marshal class methods which have
       # potential security issues leading to remote code execution when
       # loading from an untrusted source.
       #

data/lib/rubocop/cop/security/open.rb

@@ -3,7 +3,7 @@
 module RuboCop
   module Cop
     module Security
-      # This cop checks for the use of `Kernel#open` and `URI.open` with dynamic
+      # Checks for the use of `Kernel#open` and `URI.open` with dynamic
       # data.
       #
       # `Kernel#open` and `URI.open` enable not only file access but also process
@@ -23,6 +23,7 @@ module RuboCop
       #   # bad
       #   open(something)
       #   open("| #{something}")
+      #   open("| foo")
       #   URI.open(something)
       #
       #   # good
@@ -32,7 +33,6 @@ module RuboCop
       #
       #   # good (literal strings)
       #   open("foo.text")
-      #   open("| foo")
       #   URI.open("http://example.com")
       class Open < Base
         MSG = 'The use of `%<receiver>sopen` is a serious security risk.'
@@ -40,7 +40,7 @@ module RuboCop
 
         # @!method open?(node)
         def_node_matcher :open?, <<~PATTERN
-          (send ${nil? (const {nil? cbase} :URI)} :open $!str ...)
+          (send ${nil? (const {nil? cbase} :URI)} :open $_ ...)
         PATTERN
 
         def on_send(node)

data/lib/rubocop/cop/security/yaml_load.rb

@@ -3,21 +3,25 @@
 module RuboCop
   module Cop
     module Security
-      # This cop checks for the use of YAML class methods which have
+      # Checks for the use of YAML class methods which have
       # potential security issues leading to remote code execution when
       # loading from an untrusted source.
       #
+      # NOTE: Ruby 3.1+ (Psych 4) uses `Psych.load` as `Psych.safe_load` by default.
+      #
       # @safety
-      #   The behaviour of the code might change depending on what was
+      #   The behavior of the code might change depending on what was
       #   in the YAML payload, since `YAML.safe_load` is more restrictive.
       #
       # @example
       #   # bad
-      #   YAML.load("--- foo")
+      #   YAML.load("--- !ruby/object:Foo {}") # Psych 3 is unsafe by default
       #
       #   # good
-      #   YAML.safe_load("--- foo")
-      #   YAML.dump("foo")
+      #   YAML.safe_load("--- !ruby/object:Foo {}", [Foo])                    # Ruby 2.5  (Psych 3)
+      #   YAML.safe_load("--- !ruby/object:Foo {}", permitted_classes: [Foo]) # Ruby 3.0- (Psych 3)
+      #   YAML.load("--- !ruby/object:Foo {}", permitted_classes: [Foo])      # Ruby 3.1+ (Psych 4)
+      #   YAML.dump(foo)
       #
       class YAMLLoad < Base
         extend AutoCorrector
@@ -31,6 +35,8 @@ module RuboCop
         PATTERN
 
         def on_send(node)
+          return if target_ruby_version >= 3.1
+
           yaml_load(node) do
             add_offense(node.loc.selector) do |corrector|
               corrector.replace(node.loc.selector, 'safe_load')

data/lib/rubocop/cop/style/access_modifier_declarations.rb

@@ -8,6 +8,22 @@ module RuboCop
       # EnforcedStyle config covers only method definitions.
       # Applications of visibility methods to symbols can be controlled
       # using AllowModifiersOnSymbols config.
+      # Also, the visibility of `attr*` methods can be controlled using
+      # AllowModifiersOnAttrs config.
+      #
+      # In Ruby 3.0, `attr*` methods now return an array of defined method names
+      # as symbols. So we can write the modifier and `attr*` in inline style.
+      # AllowModifiersOnAttrs config allows `attr*` methods to be written in
+      # inline style without modifying applications that have been maintained
+      # for a long time in group style. Furthermore, developers who are not very
+      # familiar with Ruby may know that the modifier applies to `def`, but they
+      # may not know that it also applies to `attr*` methods. It would be easier
+      # to understand if we could write `attr*` methods in inline style.
+      #
+      # @safety
+      #   Autocorrection is not safe, because the visibility of dynamically
+      #   defined methods can vary depending on the state determined by
+      #   the group access modifier.
       #
       # @example EnforcedStyle: group (default)
       #   # bad
@@ -62,8 +78,39 @@ module RuboCop
       #     private :bar, :baz
       #
       #   end
+      #
+      # @example AllowModifiersOnAttrs: true (default)
+      #   # good
+      #   class Foo
+      #
+      #     public attr_reader :bar
+      #     protected attr_writer :baz
+      #     private attr_accessor :qux
+      #     private attr :quux
+      #
+      #     def public_method; end
+      #
+      #     private
+      #
+      #     def private_method; end
+      #
+      #   end
+      #
+      # @example AllowModifiersOnAttrs: false
+      #   # bad
+      #   class Foo
+      #
+      #     public attr_reader :bar
+      #     protected attr_writer :baz
+      #     private attr_accessor :qux
+      #     private attr :quux
+      #
+      #   end
       class AccessModifierDeclarations < Base
+        extend AutoCorrector
+
         include ConfigurableEnforcedStyle
+        include RangeHelp
 
         GROUP_STYLE_MESSAGE = [
           '`%<access_modifier>s` should not be',
@@ -77,18 +124,30 @@ module RuboCop
 
         RESTRICT_ON_SEND = %i[private protected public module_function].freeze
 
+        ALLOWED_NODE_TYPES = %i[pair block].freeze
+
         # @!method access_modifier_with_symbol?(node)
         def_node_matcher :access_modifier_with_symbol?, <<~PATTERN
           (send nil? {:private :protected :public :module_function} (sym _))
         PATTERN
 
+        # @!method access_modifier_with_attr?(node)
+        def_node_matcher :access_modifier_with_attr?, <<~PATTERN
+          (send nil? {:private :protected :public :module_function}
+            (send nil? {:attr :attr_reader :attr_writer :attr_accessor} _))
+        PATTERN
+
         def on_send(node)
           return unless node.access_modifier?
-          return if node.parent&.pair_type?
+          return if ALLOWED_NODE_TYPES.include?(node.parent&.type)
           return if allow_modifiers_on_symbols?(node)
+          return if allow_modifiers_on_attrs?(node)
 
           if offense?(node)
-            add_offense(node.loc.selector) { opposite_style_detected }
+            add_offense(node.loc.selector) do |corrector|
+              autocorrect(corrector, node)
+            end
+            opposite_style_detected
           else
             correct_style_detected
           end
@@ -96,12 +155,32 @@ module RuboCop
 
         private
 
+        def autocorrect(corrector, node)
+          case style
+          when :group
+            def_node = find_corresponding_def_node(node)
+            return unless def_node
+
+            replace_def(corrector, node, def_node)
+          when :inline
+            remove_node(corrector, node)
+            select_grouped_def_nodes(node).each do |grouped_def_node|
+              insert_inline_modifier(corrector, grouped_def_node, node.method_name)
+            end
+          end
+        end
+
         def allow_modifiers_on_symbols?(node)
           cop_config['AllowModifiersOnSymbols'] && access_modifier_with_symbol?(node)
         end
 
+        def allow_modifiers_on_attrs?(node)
+          cop_config['AllowModifiersOnAttrs'] && access_modifier_with_attr?(node)
+        end
+
         def offense?(node)
-          (group_style? && access_modifier_is_inlined?(node)) ||
+          (group_style? && access_modifier_is_inlined?(node) &&
+            !right_siblings_same_inline_method?(node)) ||
             (inline_style? && access_modifier_is_not_inlined?(node))
         end
 
@@ -121,6 +200,12 @@ module RuboCop
           !access_modifier_is_inlined?(node)
         end
 
+        def right_siblings_same_inline_method?(node)
+          node.right_siblings.any? do |sibling|
+            sibling.send_type? && sibling.method?(node.method_name) && !sibling.arguments.empty?
+          end
+        end
+
         def message(range)
           access_modifier = range.source
 
@@ -130,6 +215,60 @@ module RuboCop
             format(INLINE_STYLE_MESSAGE, access_modifier: access_modifier)
           end
         end
+
+        def find_corresponding_def_node(node)
+          if access_modifier_with_symbol?(node)
+            method_name = node.first_argument.value
+            node.parent.each_child_node(:def).find do |child|
+              child.method?(method_name)
+            end
+          else
+            node.first_argument
+          end
+        end
+
+        def find_argument_less_modifier_node(node)
+          return unless (parent = node.parent)
+
+          parent.each_child_node(:send).find do |child|
+            child.method?(node.method_name) && child.arguments.empty?
+          end
+        end
+
+        def select_grouped_def_nodes(node)
+          node.right_siblings.take_while do |sibling|
+            !(sibling.send_type? && sibling.bare_access_modifier_declaration?)
+          end.select(&:def_type?)
+        end
+
+        def replace_def(corrector, node, def_node)
+          source = def_source(node, def_node)
+          argument_less_modifier_node = find_argument_less_modifier_node(node)
+          if argument_less_modifier_node
+            corrector.insert_after(argument_less_modifier_node, "\n\n#{source}")
+          elsif (ancestor = node.each_ancestor(:block, :class, :module).first)
+
+            corrector.insert_before(ancestor.loc.end, "#{node.method_name}\n\n#{source}\n")
+          else
+            corrector.replace(node, "#{node.method_name}\n\n#{source}")
+            return
+          end
+
+          remove_node(corrector, def_node)
+          remove_node(corrector, node)
+        end
+
+        def insert_inline_modifier(corrector, node, modifier_name)
+          corrector.insert_before(node, "#{modifier_name} ")
+        end
+
+        def remove_node(corrector, node)
+          corrector.remove(range_with_comments_and_lines(node))
+        end
+
+        def def_source(node, def_node)
+          [*processed_source.ast_with_comments[node].map(&:text), def_node.source].join("\n")
+        end
       end
     end
   end

data/lib/rubocop/cop/style/accessor_grouping.rb

@@ -3,23 +3,36 @@
 module RuboCop
   module Cop
     module Style
-      # This cop checks for grouping of accessors in `class` and `module` bodies.
+      # Checks for grouping of accessors in `class` and `module` bodies.
       # By default it enforces accessors to be placed in grouped declarations,
       # but it can be configured to enforce separating them in multiple declarations.
       #
-      # NOTE: `Sorbet` is not compatible with "grouped" style. Consider "separated" style
-      # or disabling this cop.
+      # NOTE: If there is a method call before the accessor method it is always allowed
+      # as it might be intended like Sorbet.
       #
       # @example EnforcedStyle: grouped (default)
       #   # bad
       #   class Foo
       #     attr_reader :bar
+      #     attr_reader :bax
       #     attr_reader :baz
       #   end
       #
       #   # good
       #   class Foo
-      #     attr_reader :bar, :baz
+      #     attr_reader :bar, :bax, :baz
+      #   end
+      #
+      #   # good
+      #   class Foo
+      #     # may be intended comment for bar.
+      #     attr_reader :bar
+      #
+      #     sig { returns(String) }
+      #     attr_reader :bax
+      #
+      #     may_be_intended_annotation :baz
+      #     attr_reader :baz
       #   end
       #
       # @example EnforcedStyle: separated
@@ -43,11 +56,9 @@ module RuboCop
         GROUPED_MSG = 'Group together all `%<accessor>s` attributes.'
         SEPARATED_MSG = 'Use one attribute per `%<accessor>s`.'
 
-        ACCESSOR_METHODS = %i[attr_reader attr_writer attr_accessor attr].freeze
-
         def on_class(node)
           class_send_elements(node).each do |macro|
-            next unless accessor?(macro)
+            next unless macro.attribute_accessor?
 
             check(macro)
           end
@@ -58,8 +69,8 @@ module RuboCop
         private
 
         def check(send_node)
-          return if previous_line_comment?(send_node)
-          return unless (grouped_style? && sibling_accessors(send_node).size > 1) ||
+          return if previous_line_comment?(send_node) || !groupable_accessor?(send_node)
+          return unless (grouped_style? && groupable_sibling_accessors(send_node).size > 1) ||
                         (separated_style? && send_node.arguments.size > 1)
 
           message = message(send_node)
@@ -72,7 +83,7 @@ module RuboCop
           if (preferred_accessors = preferred_accessors(node))
             corrector.replace(node, preferred_accessors)
           else
-            range = range_with_surrounding_space(range: node.loc.expression, side: :left)
+            range = range_with_surrounding_space(node.source_range, side: :left)
             corrector.remove(range)
           end
         end
@@ -81,6 +92,25 @@ module RuboCop
           comment_line?(processed_source[node.first_line - 2])
         end
 
+        # rubocop:disable Metrics/CyclomaticComplexity
+        def groupable_accessor?(node)
+          return true unless (previous_expression = node.left_siblings.last)
+
+          # Accessors with Sorbet `sig { ... }` blocks shouldn't be groupable.
+          if previous_expression.block_type?
+            previous_expression.child_nodes.each do |child_node|
+              break previous_expression = child_node if child_node.send_type?
+            end
+          end
+
+          return true unless previous_expression.send_type?
+
+          previous_expression.attribute_accessor? ||
+            previous_expression.access_modifier? ||
+            node.first_line - previous_expression.last_line > 1 # there is a space between nodes
+        end
+        # rubocop:enable Metrics/CyclomaticComplexity
+
         def class_send_elements(class_node)
           class_def = class_node.body
 
@@ -93,10 +123,6 @@ module RuboCop
           end
         end
 
-        def accessor?(send_node)
-          send_node.macro? && ACCESSOR_METHODS.include?(send_node.method_name)
-        end
-
         def grouped_style?
           style == :grouped
         end
@@ -105,12 +131,12 @@ module RuboCop
           style == :separated
         end
 
-        def sibling_accessors(send_node)
+        def groupable_sibling_accessors(send_node)
           send_node.parent.each_child_node(:send).select do |sibling|
-            accessor?(sibling) &&
+            sibling.attribute_accessor? &&
               sibling.method?(send_node.method_name) &&
               node_visibility(sibling) == node_visibility(send_node) &&
-              !previous_line_comment?(sibling)
+              groupable_accessor?(sibling) && !previous_line_comment?(sibling)
           end
         end
 
@@ -121,26 +147,30 @@ module RuboCop
 
         def preferred_accessors(node)
           if grouped_style?
-            accessors = sibling_accessors(node)
-            group_accessors(node, accessors) if node == accessors.first
+            accessors = groupable_sibling_accessors(node)
+            group_accessors(node, accessors) if node.loc == accessors.first.loc
           else
             separate_accessors(node)
           end
         end
 
         def group_accessors(node, accessors)
-          accessor_names = accessors.flat_map { |accessor| accessor.arguments.map(&:source) }
+          accessor_names = accessors.flat_map { |accessor| accessor.arguments.map(&:source) }.uniq
 
           "#{node.method_name} #{accessor_names.join(', ')}"
         end
 
         def separate_accessors(node)
-          node.arguments.map do |arg|
-            if arg == node.arguments.first
+          node.arguments.flat_map do |arg|
+            lines = [
+              *processed_source.ast_with_comments[arg].map(&:text),
               "#{node.method_name} #{arg.source}"
+            ]
+            if arg == node.first_argument
+              lines
             else
               indent = ' ' * node.loc.column
-              "#{indent}#{node.method_name} #{arg.source}"
+              lines.map { |line| "#{indent}#{line}" }
             end
           end.join("\n")
         end

data/lib/rubocop/cop/style/alias.rb

@@ -3,10 +3,15 @@
 module RuboCop
   module Cop
     module Style
-      # This cop enforces the use of either `#alias` or `#alias_method`
+      # Enforces the use of either `#alias` or `#alias_method`
       # depending on configuration.
       # It also flags uses of `alias :symbol` rather than `alias bareword`.
       #
+      # However, it will always enforce `method_alias` when used `alias`
+      # in an instance method definition and in a singleton method definition.
+      # If used in a block, always enforce `alias_method`
+      # unless it is an `instance_eval` block.
+      #
       # @example EnforcedStyle: prefer_alias (default)
       #   # bad
       #   alias_method :bar, :foo
@@ -22,6 +27,7 @@ module RuboCop
       #
       #   # good
       #   alias_method :bar, :foo
+      #
       class Alias < Base
         include ConfigurableEnforcedStyle
         extend AutoCorrector
@@ -35,6 +41,7 @@ module RuboCop
         def on_send(node)
           return unless node.command?(:alias_method)
           return unless style == :prefer_alias && alias_keyword_possible?(node)
+          return unless node.arguments.count == 2
 
           msg = format(MSG_ALIAS_METHOD, current: lexical_scope_type(node))
           add_offense(node.loc.selector, message: msg) do |corrector|
@@ -71,12 +78,14 @@ module RuboCop
         end
 
         def alias_method_possible?(node)
-          scope_type(node) != :instance_eval && node.children.none?(&:gvar_type?)
+          scope_type(node) != :instance_eval &&
+            node.children.none?(&:gvar_type?) &&
+            node&.parent&.type != :def
         end
 
         def add_offense_for_args(node, &block)
           existing_args  = node.children.map(&:source).join(' ')
-          preferred_args = node.children.map { |a| a.source[1..-1] }.join(' ')
+          preferred_args = node.children.map { |a| a.source[1..] }.join(' ')
           arg_ranges     = node.children.map(&:source_range)
           msg            = format(MSG_SYMBOL_ARGS, prefer: preferred_args, current: existing_args)
           add_offense(arg_ranges.reduce(&:join), message: msg, &block)
@@ -114,7 +123,7 @@ module RuboCop
         end
 
         def bareword?(sym_node)
-          !sym_node.source.start_with?(':')
+          !sym_node.source.start_with?(':') || sym_node.dsym_type?
         end
 
         def correct_alias_method_to_alias(corrector, send_node)
@@ -126,22 +135,23 @@ module RuboCop
 
         def correct_alias_to_alias_method(corrector, node)
           replacement =
-            'alias_method ' \
-            ":#{identifier(node.new_identifier)}, " \
-            ":#{identifier(node.old_identifier)}"
+            "alias_method #{identifier(node.new_identifier)}, #{identifier(node.old_identifier)}"
 
           corrector.replace(node, replacement)
         end
 
         def correct_alias_with_symbol_args(corrector, node)
-          corrector.replace(node.new_identifier, node.new_identifier.source[1..-1])
-          corrector.replace(node.old_identifier, node.old_identifier.source[1..-1])
+          corrector.replace(node.new_identifier, node.new_identifier.source[1..])
+          corrector.replace(node.old_identifier, node.old_identifier.source[1..])
         end
 
-        # @!method identifier(node)
-        def_node_matcher :identifier, <<~PATTERN
-          (sym $_)
-        PATTERN
+        def identifier(node)
+          if node.sym_type?
+            ":#{node.children.first}"
+          else
+            node.source
+          end
+        end
       end
     end
   end