rubocop 1.53.0 → 1.90.0

data/lib/rubocop/cop/security.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    # Cops for the `Security` department. The department's cops are registered for lazy loading
+    # and their files are loaded on demand.
+    module Security
+      extend LazyLoader
+
+      register_cop :CompoundHash, "#{__dir__}/security/compound_hash"
+      register_cop :Eval, "#{__dir__}/security/eval"
+      register_cop :IoMethods, "#{__dir__}/security/io_methods"
+      register_cop :JSONLoad, "#{__dir__}/security/json_load"
+      register_cop :MarshalLoad, "#{__dir__}/security/marshal_load"
+      register_cop :Open, "#{__dir__}/security/open"
+      register_cop :YAMLLoad, "#{__dir__}/security/yaml_load"
+    end
+  end
+end

data/lib/rubocop/cop/style/access_modifier_declarations.rb

@@ -8,6 +8,17 @@ module RuboCop
       # EnforcedStyle config covers only method definitions.
       # Applications of visibility methods to symbols can be controlled
       # using AllowModifiersOnSymbols config.
+      # Also, the visibility of `attr*` methods can be controlled using
+      # AllowModifiersOnAttrs config.
+      #
+      # In Ruby 3.0, `attr*` methods now return an array of defined method names
+      # as symbols. So we can write the modifier and `attr*` in inline style.
+      # AllowModifiersOnAttrs config allows `attr*` methods to be written in
+      # inline style without modifying applications that have been maintained
+      # for a long time in group style. Furthermore, developers who are not very
+      # familiar with Ruby may know that the modifier applies to `def`, but they
+      # may not know that it also applies to `attr*` methods. It would be easier
+      # to understand if we could write `attr*` methods in inline style.
       #
       # @safety
       #   Autocorrection is not safe, because the visibility of dynamically
@@ -57,6 +68,9 @@ module RuboCop
       #   class Foo
       #
       #     private :bar, :baz
+      #     private *%i[qux quux]
+      #     private *METHOD_NAMES
+      #     private *private_methods
       #
       #   end
       #
@@ -65,6 +79,57 @@ module RuboCop
       #   class Foo
       #
       #     private :bar, :baz
+      #     private *%i[qux quux]
+      #     private *METHOD_NAMES
+      #     private *private_methods
+      #
+      #   end
+      #
+      # @example AllowModifiersOnAttrs: true (default)
+      #   # good
+      #   class Foo
+      #
+      #     public attr_reader :bar
+      #     protected attr_writer :baz
+      #     private attr_accessor :qux
+      #     private attr :quux
+      #
+      #     def public_method; end
+      #
+      #     private
+      #
+      #     def private_method; end
+      #
+      #   end
+      #
+      # @example AllowModifiersOnAttrs: false
+      #   # bad
+      #   class Foo
+      #
+      #     public attr_reader :bar
+      #     protected attr_writer :baz
+      #     private attr_accessor :qux
+      #     private attr :quux
+      #
+      #   end
+      #
+      # @example AllowModifiersOnAliasMethod: true (default)
+      #   # good
+      #   class Foo
+      #
+      #     public alias_method :bar, :foo
+      #     protected alias_method :baz, :foo
+      #     private alias_method :qux, :foo
+      #
+      #   end
+      #
+      # @example AllowModifiersOnAliasMethod: false
+      #   # bad
+      #   class Foo
+      #
+      #     public alias_method :bar, :foo
+      #     protected alias_method :baz, :foo
+      #     private alias_method :qux, :foo
       #
       #   end
       class AccessModifierDeclarations < Base
@@ -85,17 +150,27 @@ module RuboCop
 
         RESTRICT_ON_SEND = %i[private protected public module_function].freeze
 
-        ALLOWED_NODE_TYPES = %i[pair block].freeze
-
         # @!method access_modifier_with_symbol?(node)
         def_node_matcher :access_modifier_with_symbol?, <<~PATTERN
-          (send nil? {:private :protected :public :module_function} (sym _))
+          (send nil? {:private :protected :public :module_function}
+            {(sym _)+ (splat {#percent_symbol_array? const send})}
+          )
+        PATTERN
+
+        # @!method access_modifier_with_attr?(node)
+        def_node_matcher :access_modifier_with_attr?, <<~PATTERN
+          (send nil? {:private :protected :public :module_function}
+            (send nil? {:attr :attr_reader :attr_writer :attr_accessor} _+))
+        PATTERN
+
+        # @!method access_modifier_with_alias_method?, <<~PATTERN
+        def_node_matcher :access_modifier_with_alias_method?, <<~PATTERN
+          (send nil? {:private :protected :public :module_function}
+            (send nil? :alias_method _ _))
         PATTERN
 
         def on_send(node)
-          return unless node.access_modifier?
-          return if ALLOWED_NODE_TYPES.include?(node.parent&.type)
-          return if allow_modifiers_on_symbols?(node)
+          return if allowed?(node)
 
           if offense?(node)
             add_offense(node.loc.selector) do |corrector|
@@ -109,29 +184,72 @@ module RuboCop
 
         private
 
+        def allowed?(node)
+          !node.access_modifier? ||
+            node.parent&.type?(:pair, :any_block) ||
+            allow_modifiers_on_symbols?(node) ||
+            allow_modifiers_on_attrs?(node) ||
+            allow_modifiers_on_alias_method?(node)
+        end
+
         def autocorrect(corrector, node)
           case style
           when :group
-            def_node = find_corresponding_def_node(node)
-            return unless def_node
-
-            replace_def(corrector, node, def_node)
+            autocorrect_group_style(corrector, node)
           when :inline
-            remove_node(corrector, node)
-            select_grouped_def_nodes(node).each do |grouped_def_node|
-              insert_inline_modifier(corrector, grouped_def_node, node.method_name)
-            end
+            autocorrect_inline_style(corrector, node)
+          end
+        end
+
+        def autocorrect_group_style(corrector, node)
+          def_nodes = find_corresponding_def_nodes(node)
+          return unless def_nodes.any?
+
+          replace_defs(corrector, node, def_nodes)
+        end
+
+        def autocorrect_inline_style(corrector, node)
+          if node.parent&.begin_type?
+            remove_modifier_node_within_begin(corrector, node, node.parent)
+          else
+            remove_nodes(corrector, node)
           end
+          select_grouped_def_nodes(node).each do |grouped_def_node|
+            insert_inline_modifier(corrector, grouped_def_node, node.method_name)
+          end
+        end
+
+        def percent_symbol_array?(node)
+          node.array_type? && node.percent_literal?(:symbol)
         end
 
         def allow_modifiers_on_symbols?(node)
           cop_config['AllowModifiersOnSymbols'] && access_modifier_with_symbol?(node)
         end
 
+        def allow_modifiers_on_attrs?(node)
+          cop_config['AllowModifiersOnAttrs'] && access_modifier_with_attr?(node)
+        end
+
+        def allow_modifiers_on_alias_method?(node)
+          cop_config['AllowModifiersOnAliasMethod'] && access_modifier_with_alias_method?(node)
+        end
+
         def offense?(node)
-          (group_style? && access_modifier_is_inlined?(node) &&
-            !right_siblings_same_inline_method?(node)) ||
-            (inline_style? && access_modifier_is_not_inlined?(node))
+          if group_style?
+            return false if node.parent ? node.parent.if_type? : access_modifier_with_symbol?(node)
+
+            access_modifier_is_inlined?(node) && !right_siblings_same_inline_method?(node)
+          else
+            access_modifier_is_not_inlined?(node) && select_grouped_def_nodes(node).any?
+          end
+        end
+
+        def correctable_group_offense?(node)
+          return false unless group_style?
+          return false if allowed?(node)
+
+          access_modifier_is_inlined?(node) && find_corresponding_def_nodes(node).any?
         end
 
         def group_style?
@@ -152,7 +270,11 @@ module RuboCop
 
         def right_siblings_same_inline_method?(node)
           node.right_siblings.any? do |sibling|
-            sibling.send_type? && sibling.method?(node.method_name) && !sibling.arguments.empty?
+            sibling.send_type? &&
+              correctable_group_offense?(sibling) &&
+              sibling.method?(node.method_name) &&
+              !sibling.arguments.empty? &&
+              find_corresponding_def_nodes(sibling).any?
           end
         end
 
@@ -166,14 +288,22 @@ module RuboCop
           end
         end
 
-        def find_corresponding_def_node(node)
+        def find_corresponding_def_nodes(node)
           if access_modifier_with_symbol?(node)
-            method_name = node.arguments.first.value
-            node.parent.each_child_node(:def).find do |child|
-              child.method?(method_name)
+            method_names = node.arguments.filter_map do |argument|
+              next unless argument.sym_type?
+
+              argument.respond_to?(:value) && argument.value
+            end
+
+            def_nodes = node.parent.each_child_node(:def).select do |child|
+              method_names.include?(child.method_name)
             end
+
+            # If there isn't a `def` node for each symbol, we will skip autocorrection.
+            def_nodes.size == method_names.size ? def_nodes : []
           else
-            node.arguments.first
+            [node.first_argument]
           end
         end
 
@@ -191,33 +321,54 @@ module RuboCop
           end.select(&:def_type?)
         end
 
-        def replace_def(corrector, node, def_node)
-          source = def_source(node, def_node)
+        def replace_defs(corrector, node, def_nodes)
+          source = def_source(node, def_nodes)
           argument_less_modifier_node = find_argument_less_modifier_node(node)
           if argument_less_modifier_node
             corrector.insert_after(argument_less_modifier_node, "\n\n#{source}")
-          elsif (ancestor = node.each_ancestor(:block, :class, :module).first)
-
+          elsif (ancestor = node.each_ancestor(:class, :module, :sclass).first)
             corrector.insert_before(ancestor.loc.end, "#{node.method_name}\n\n#{source}\n")
           else
             corrector.replace(node, "#{node.method_name}\n\n#{source}")
             return
           end
 
-          remove_node(corrector, def_node)
-          remove_node(corrector, node)
+          remove_nodes(corrector, *def_nodes, node)
         end
 
         def insert_inline_modifier(corrector, node, modifier_name)
           corrector.insert_before(node, "#{modifier_name} ")
         end
 
-        def remove_node(corrector, node)
-          corrector.remove(range_with_comments_and_lines(node))
+        def remove_nodes(corrector, *nodes)
+          nodes.each do |node|
+            corrector.remove(range_with_comments_and_lines(node))
+          end
+        end
+
+        def remove_modifier_node_within_begin(corrector, modifier_node, begin_node)
+          def_node = begin_node.children[begin_node.children.index(modifier_node) + 1]
+          # Stop the removal range at the first comment that precedes the def, if
+          # any exist. Without this, comments between the modifier and the def are
+          # dropped because they fall inside the removed range.
+          end_pos = first_comment_or_node_start(def_node)
+          corrector.remove(modifier_node.source_range.begin.join(end_pos))
+        end
+
+        def first_comment_or_node_start(node)
+          preceding = processed_source.ast_with_comments[node].select do |comment|
+            comment.loc.line < node.loc.line
+          end
+          return node.source_range.begin if preceding.empty?
+
+          preceding.first.source_range.begin
         end
 
-        def def_source(node, def_node)
-          [*processed_source.ast_with_comments[node].map(&:text), def_node.source].join("\n")
+        def def_source(node, def_nodes)
+          [
+            *processed_source.ast_with_comments[node].map(&:text),
+            *def_nodes.map(&:source)
+          ].join("\n")
         end
       end
     end

data/lib/rubocop/cop/style/accessor_grouping.rb

@@ -4,12 +4,17 @@ module RuboCop
   module Cop
     module Style
       # Checks for grouping of accessors in `class` and `module` bodies.
-      # By default it enforces accessors to be placed in grouped declarations,
-      # but it can be configured to enforce separating them in multiple declarations.
+      # By default it enforces accessors to be placed in grouped
+      # declarations, reducing boilerplate. It can also be configured
+      # to enforce separating them into individual declarations for
+      # easier diffing and per-attribute documentation.
       #
       # NOTE: If there is a method call before the accessor method it is always allowed
       # as it might be intended like Sorbet.
       #
+      # NOTE: If there is a RBS::Inline annotation comment just after the accessor method
+      # it is always allowed.
+      #
       # @example EnforcedStyle: grouped (default)
       #   # bad
       #   class Foo
@@ -81,7 +86,10 @@ module RuboCop
 
         def autocorrect(corrector, node)
           if (preferred_accessors = preferred_accessors(node))
-            corrector.replace(node, preferred_accessors)
+            corrector.replace(
+              grouped_style? ? node : range_with_trailing_argument_comment(node),
+              preferred_accessors
+            )
           else
             range = range_with_surrounding_space(node.source_range, side: :left)
             corrector.remove(range)
@@ -92,7 +100,7 @@ module RuboCop
           comment_line?(processed_source[node.first_line - 2])
         end
 
-        # rubocop:disable Metrics/CyclomaticComplexity
+        # rubocop:disable-next Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
         def groupable_accessor?(node)
           return true unless (previous_expression = node.left_siblings.last)
 
@@ -105,11 +113,15 @@ module RuboCop
 
           return true unless previous_expression.send_type?
 
+          # Accessors with RBS::Inline annotations shouldn't be groupable.
+          return false if processed_source.comments.any? do |c|
+            same_line?(c, previous_expression) && c.text.start_with?('#:')
+          end
+
           previous_expression.attribute_accessor? ||
             previous_expression.access_modifier? ||
             node.first_line - previous_expression.last_line > 1 # there is a space between nodes
         end
-        # rubocop:enable Metrics/CyclomaticComplexity
 
         def class_send_elements(class_node)
           class_def = class_node.body
@@ -131,12 +143,16 @@ module RuboCop
           style == :separated
         end
 
+        def groupable_sibling_accessor?(node, sibling)
+          sibling.attribute_accessor? &&
+            sibling.method?(node.method_name) &&
+            node_visibility(sibling) == node_visibility(node) &&
+            groupable_accessor?(sibling) && !previous_line_comment?(sibling)
+        end
+
         def groupable_sibling_accessors(send_node)
           send_node.parent.each_child_node(:send).select do |sibling|
-            sibling.attribute_accessor? &&
-              sibling.method?(send_node.method_name) &&
-              node_visibility(sibling) == node_visibility(send_node) &&
-              groupable_accessor?(sibling) && !previous_line_comment?(sibling)
+            groupable_sibling_accessor?(send_node, sibling)
           end
         end
 
@@ -147,13 +163,23 @@ module RuboCop
 
         def preferred_accessors(node)
           if grouped_style?
+            return if skip_for_grouping?(node)
+
             accessors = groupable_sibling_accessors(node)
-            group_accessors(node, accessors) if node.loc == accessors.first.loc
+            if node.loc == accessors.first.loc || skip_for_grouping?(accessors.first)
+              group_accessors(node, accessors)
+            end
           else
             separate_accessors(node)
           end
         end
 
+        # Group after constants
+        def skip_for_grouping?(node)
+          node.right_siblings.any?(&:casgn_type?) &&
+            node.right_siblings.any? { |n| n.send_type? && groupable_sibling_accessor?(node, n) }
+        end
+
         def group_accessors(node, accessors)
           accessor_names = accessors.flat_map { |accessor| accessor.arguments.map(&:source) }.uniq
 
@@ -166,7 +192,7 @@ module RuboCop
               *processed_source.ast_with_comments[arg].map(&:text),
               "#{node.method_name} #{arg.source}"
             ]
-            if arg == node.arguments.first
+            if arg == node.first_argument
               lines
             else
               indent = ' ' * node.loc.column
@@ -174,6 +200,25 @@ module RuboCop
             end
           end.join("\n")
         end
+
+        def range_with_trailing_argument_comment(node)
+          comment = trailing_argument_comment(node)
+          if comment
+            add_range(node.source_range, comment.source_range)
+          else
+            node
+          end
+        end
+
+        # For a single-line declaration the parser associates the trailing
+        # comment with the first argument, not `last_argument`, so look through
+        # all arguments for a comment that trails the whole node.
+        def trailing_argument_comment(node)
+          comments = node.arguments.filter_map do |argument|
+            processed_source.ast_with_comments[argument].last
+          end
+          comments.find { |comment| comment.source_range.begin_pos >= node.source_range.end_pos }
+        end
       end
     end
   end

data/lib/rubocop/cop/style/alias.rb

@@ -4,10 +4,13 @@ module RuboCop
   module Cop
     module Style
       # Enforces the use of either `#alias` or `#alias_method`
-      # depending on configuration.
+      # depending on configuration. Consistent use of one or the
+      # other prevents confusion about their different semantics
+      # (e.g., `alias` is resolved at parse time, while `alias_method`
+      # is resolved at runtime).
       # It also flags uses of `alias :symbol` rather than `alias bareword`.
       #
-      # However, it will always enforce `method_alias` when used `alias`
+      # However, it will always enforce `alias_method` when `alias` is used
       # in an instance method definition and in a singleton method definition.
       # If used in a block, always enforce `alias_method`
       # unless it is an `instance_eval` block.
@@ -41,6 +44,8 @@ module RuboCop
         def on_send(node)
           return unless node.command?(:alias_method)
           return unless style == :prefer_alias && alias_keyword_possible?(node)
+          return unless node.arguments.count == 2
+          return if alias_method_value_used?(node)
 
           msg = format(MSG_ALIAS_METHOD, current: lexical_scope_type(node))
           add_offense(node.loc.selector, message: msg) do |corrector|
@@ -76,10 +81,18 @@ module RuboCop
           scope_type(node) != :dynamic && node.arguments.all?(&:sym_type?)
         end
 
+        # `alias_method` is a method call whose return value can be used
+        # (e.g., as an argument to `public`/`module_function`, or as an assignment),
+        # but `alias` is a keyword statement that cannot appear in such positions.
+        # Detect these positions so the conversion does not produce a syntax error.
+        def alias_method_value_used?(node)
+          node.argument? || node.parent&.assignment?
+        end
+
         def alias_method_possible?(node)
           scope_type(node) != :instance_eval &&
             node.children.none?(&:gvar_type?) &&
-            node&.parent&.type != :def
+            node.each_ancestor(:def).none?
         end
 
         def add_offense_for_args(node, &block)
@@ -100,7 +113,7 @@ module RuboCop
               return :lexical
             when :def, :defs
               return :dynamic
-            when :block
+            when :block, :numblock, :itblock
               return :instance_eval if parent.method?(:instance_eval)
 
               return :dynamic
@@ -122,7 +135,7 @@ module RuboCop
         end
 
         def bareword?(sym_node)
-          !sym_node.source.start_with?(':')
+          !sym_node.source.start_with?(':') || sym_node.dsym_type?
         end
 
         def correct_alias_method_to_alias(corrector, send_node)
@@ -134,9 +147,7 @@ module RuboCop
 
         def correct_alias_to_alias_method(corrector, node)
           replacement =
-            'alias_method ' \
-            ":#{identifier(node.new_identifier)}, " \
-            ":#{identifier(node.old_identifier)}"
+            "alias_method #{identifier(node.new_identifier)}, #{identifier(node.old_identifier)}"
 
           corrector.replace(node, replacement)
         end
@@ -146,10 +157,13 @@ module RuboCop
           corrector.replace(node.old_identifier, node.old_identifier.source[1..])
         end
 
-        # @!method identifier(node)
-        def_node_matcher :identifier, <<~PATTERN
-          (sym $_)
-        PATTERN
+        def identifier(node)
+          if node.sym_type?
+            ":#{node.children.first}"
+          else
+            node.source
+          end
+        end
       end
     end
   end

data/lib/rubocop/cop/style/ambiguous_endless_method_definition.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Style
+      # Looks for endless methods inside operations of lower precedence (`and`, `or`, and
+      # modifier forms of `if`, `unless`, `while`, `until`) that are ambiguous due to
+      # lack of parentheses. This may lead to unexpected behavior as the code may appear
+      # to use these keywords as part of the method but in fact they modify
+      # the method definition itself.
+      #
+      # In these cases, using a normal method definition is more clear.
+      #
+      # @example
+      #
+      #   # bad
+      #   def foo = true if bar
+      #
+      #   # good - using a non-endless method is more explicit
+      #   def foo
+      #     true
+      #   end if bar
+      #
+      #   # ok - method body is explicit
+      #   def foo = (true if bar)
+      #
+      #   # ok - method definition is explicit
+      #   (def foo = true) if bar
+      class AmbiguousEndlessMethodDefinition < Base
+        extend TargetRubyVersion
+        extend AutoCorrector
+        include EndlessMethodRewriter
+        include RangeHelp
+
+        minimum_target_ruby_version 3.0
+
+        MSG = 'Avoid using `%<keyword>s` statements with endless methods.'
+
+        # @!method ambiguous_endless_method_body(node)
+        def_node_matcher :ambiguous_endless_method_body, <<~PATTERN
+          ^${
+            (if _ <def _>)
+            ({and or} def _)
+            ({while until} _ def)
+          }
+        PATTERN
+
+        def on_def(node)
+          return unless node.endless?
+
+          operation = ambiguous_endless_method_body(node)
+          return unless operation
+
+          return unless modifier_form?(operation)
+
+          add_offense(operation, message: format(MSG, keyword: keyword(operation))) do |corrector|
+            correct_to_multiline(corrector, node)
+          end
+        end
+
+        private
+
+        def modifier_form?(operation)
+          return true if operation.operator_keyword?
+
+          operation.modifier_form?
+        end
+
+        def keyword(operation)
+          if operation.respond_to?(:keyword)
+            operation.keyword
+          else
+            operation.operator
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/style/and_or.rb

@@ -71,7 +71,7 @@ module RuboCop
             node.each_child_node do |expr|
               if expr.send_type?
                 correct_send(expr, corrector)
-              elsif expr.return_type? || expr.assignment?
+              elsif expr.type?(:return, :next, :break, :yield) || expr.assignment?
                 correct_other(expr, corrector)
               end
             end
@@ -127,7 +127,8 @@ module RuboCop
         end
 
         def correct_other(node, corrector)
-          return if node.source_range.begin.is?('(')
+          return if node.parenthesized_call?
+          return if node.children.empty? && node.equal?(node.parent.children.last)
 
           corrector.wrap(node, '(', ')')
         end