rubocop 1.57.1 → 1.81.7

data/lib/rubocop/cop/naming/predicate_prefix.rb

@@ -0,0 +1,204 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Naming
+      # Checks that predicate method names end with a question mark and
+      # do not start with a forbidden prefix.
+      #
+      # A method is determined to be a predicate method if its name starts with
+      # one of the prefixes listed in the `NamePrefix` configuration. The list
+      # defaults to `is_`, `has_`, and `have_` but may be overridden.
+      #
+      # Predicate methods must end with a question mark.
+      #
+      # When `ForbiddenPrefixes` is also set (as it is by default), predicate
+      # methods which begin with a forbidden prefix are not allowed, even if
+      # they end with a `?`. These methods should be changed to remove the
+      # prefix.
+      #
+      # When `UseSorbetSigs` set to true (optional), the cop will only report
+      # offenses if the method has a Sorbet `sig` with a return type of
+      # `T::Boolean`. Dynamic methods are not supported with this configuration.
+      #
+      # @example NamePrefix: ['is_', 'has_', 'have_'] (default)
+      #   # bad
+      #   def is_even(value)
+      #   end
+      #
+      #   # When ForbiddenPrefixes: ['is_', 'has_', 'have_'] (default)
+      #   # good
+      #   def even?(value)
+      #   end
+      #
+      #   # When ForbiddenPrefixes: []
+      #   # good
+      #   def is_even?(value)
+      #   end
+      #
+      # @example NamePrefix: ['seems_to_be_']
+      #   # bad
+      #   def seems_to_be_even(value)
+      #   end
+      #
+      #   # When ForbiddenPrefixes: ['seems_to_be_']
+      #   # good
+      #   def even?(value)
+      #   end
+      #
+      #   # When ForbiddenPrefixes: []
+      #   # good
+      #   def seems_to_be_even?(value)
+      #   end
+      #
+      # @example AllowedMethods: ['is_a?'] (default)
+      #   # Despite starting with the `is_` prefix, this method is allowed
+      #   # good
+      #   def is_a?(value)
+      #   end
+      #
+      # @example AllowedMethods: ['is_even?']
+      #   # good
+      #   def is_even?(value)
+      #   end
+      #
+      # @example UseSorbetSigs: false (default)
+      #  # bad
+      #  sig { returns(String) }
+      #  def is_this_thing_on
+      #    "yes"
+      #  end
+      #
+      #  # good - Sorbet signature is not evaluated
+      #  sig { returns(String) }
+      #  def is_this_thing_on?
+      #    "yes"
+      #  end
+      #
+      # @example UseSorbetSigs: true
+      #   # bad
+      #   sig { returns(T::Boolean) }
+      #   def odd(value)
+      #   end
+      #
+      #   # good
+      #   sig { returns(T::Boolean) }
+      #   def odd?(value)
+      #   end
+      #
+      # @example MethodDefinitionMacros: ['define_method', 'define_singleton_method'] (default)
+      #   # bad
+      #   define_method(:is_even) { |value| }
+      #
+      #   # good
+      #   define_method(:even?) { |value| }
+      #
+      # @example MethodDefinitionMacros: ['def_node_matcher']
+      #   # bad
+      #   def_node_matcher(:is_even) { |value| }
+      #
+      #   # good
+      #   def_node_matcher(:even?) { |value| }
+      #
+      class PredicatePrefix < Base
+        include AllowedMethods
+
+        # @!method dynamic_method_define(node)
+        def_node_matcher :dynamic_method_define, <<~PATTERN
+          (send nil? #method_definition_macro?
+            (sym $_)
+            ...)
+        PATTERN
+
+        def on_send(node)
+          dynamic_method_define(node) do |method_name|
+            predicate_prefixes.each do |prefix|
+              next if allowed_method_name?(method_name.to_s, prefix)
+
+              add_offense(
+                node.first_argument,
+                message: message(method_name, expected_name(method_name.to_s, prefix))
+              )
+            end
+          end
+        end
+
+        def on_def(node)
+          predicate_prefixes.each do |prefix|
+            method_name = node.method_name.to_s
+
+            next if allowed_method_name?(method_name, prefix)
+            next if use_sorbet_sigs? && !sorbet_sig?(node, return_type: 'T::Boolean')
+
+            add_offense(
+              node.loc.name,
+              message: message(method_name, expected_name(method_name, prefix))
+            )
+          end
+        end
+        alias on_defs on_def
+
+        def validate_config
+          forbidden_prefixes.each do |forbidden_prefix|
+            next if predicate_prefixes.include?(forbidden_prefix)
+
+            raise ValidationError, <<~MSG.chomp
+              The `Naming/PredicatePrefix` cop is misconfigured. Prefix #{forbidden_prefix} must be included in NamePrefix because it is included in ForbiddenPrefixes.
+            MSG
+          end
+        end
+
+        private
+
+        # @!method sorbet_return_type(node)
+        def_node_matcher :sorbet_return_type, <<~PATTERN
+          (block (send nil? :sig) args (send _ :returns $_type))
+        PATTERN
+
+        def sorbet_sig?(node, return_type: nil)
+          return false unless (type = sorbet_return_type(node.left_sibling))
+
+          type.source == return_type
+        end
+
+        def allowed_method_name?(method_name, prefix)
+          !(method_name.start_with?(prefix) && # cheap check to avoid allocating Regexp
+              method_name.match?(/^#{prefix}[^0-9]/)) ||
+            method_name == expected_name(method_name, prefix) ||
+            method_name.end_with?('=') ||
+            allowed_method?(method_name)
+        end
+
+        def expected_name(method_name, prefix)
+          new_name = if forbidden_prefixes.include?(prefix)
+                       method_name.sub(prefix, '')
+                     else
+                       method_name.dup
+                     end
+          new_name << '?' unless method_name.end_with?('?')
+          new_name
+        end
+
+        def message(method_name, new_name)
+          "Rename `#{method_name}` to `#{new_name}`."
+        end
+
+        def forbidden_prefixes
+          cop_config['ForbiddenPrefixes']
+        end
+
+        def predicate_prefixes
+          cop_config['NamePrefix']
+        end
+
+        def use_sorbet_sigs?
+          cop_config['UseSorbetSigs']
+        end
+
+        def method_definition_macro?(macro_name)
+          cop_config['MethodDefinitionMacros'].include?(macro_name.to_s)
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/naming/rescued_exceptions_variable_name.rb

@@ -109,35 +109,39 @@ module RuboCop
               variable_name_matches?(lvasgn_node, name)
             end
           else
-            node.children.first == name
+            node.name == name
           end
         end
 
+        # rubocop:disable Metrics/MethodLength
         def correct_node(corrector, node, offending_name, preferred_name)
           return unless node
 
           node.each_node(:lvar, :lvasgn, :masgn) do |child_node|
             next unless variable_name_matches?(child_node, offending_name)
 
-            corrector.replace(child_node, preferred_name) if child_node.lvar_type?
+            if child_node.lvar_type?
+              parent_node = child_node.parent
+              if parent_node.respond_to?(:value_omission?) && parent_node.value_omission?
+                corrector.insert_after(parent_node.loc.operator, " #{preferred_name}")
+              else
+                corrector.replace(child_node, preferred_name)
+              end
+            end
 
-            if child_node.masgn_type? || child_node.lvasgn_type?
+            if child_node.type?(:masgn, :lvasgn)
               correct_reassignment(corrector, child_node, offending_name, preferred_name)
               break
             end
           end
         end
+        # rubocop:enable Metrics/MethodLength
 
         # If the exception variable is reassigned, that assignment needs to be corrected.
         # Further `lvar` nodes will not be corrected though since they now refer to a
         # different variable.
         def correct_reassignment(corrector, node, offending_name, preferred_name)
-          if node.lvasgn_type?
-            correct_node(corrector, node.child_nodes.first, offending_name, preferred_name)
-          elsif node.masgn_type?
-            # With multiple assign, the assignments are in an array as the last child
-            correct_node(corrector, node.children.last, offending_name, preferred_name)
-          end
+          correct_node(corrector, node.rhs, offending_name, preferred_name)
         end
 
         def preferred_name(variable_name)
@@ -150,10 +154,7 @@ module RuboCop
         end
 
         def variable_name(node)
-          asgn_node = node.exception_variable
-          return unless asgn_node
-
-          asgn_node.children.last
+          node.exception_variable.name if node.exception_variable.respond_to?(:name)
         end
 
         def message(node)

data/lib/rubocop/cop/naming/variable_name.rb

@@ -3,8 +3,15 @@
 module RuboCop
   module Cop
     module Naming
-      # Makes sure that all variables use the configured style,
-      # snake_case or camelCase, for their names.
+      # Checks that the configured style (snake_case or camelCase) is used for all variable names.
+      # This includes local variables, instance variables, class variables, method arguments
+      # (positional, keyword, rest or block), and block arguments.
+      #
+      # The cop can also be configured to forbid using specific names for variables, using
+      # `ForbiddenIdentifiers` or `ForbiddenPatterns`. In addition to the above, this applies
+      # to global variables as well.
+      #
+      # Method definitions and method calls are not affected by this cop.
       #
       # @example EnforcedStyle: snake_case (default)
       #   # bad
@@ -26,25 +33,45 @@ module RuboCop
       #
       # @example AllowedPatterns: ['_v\d+\z']
       #   # good (with EnforcedStyle: camelCase)
-      #   :release_v1
+      #   release_v1 = true
+      #
+      # @example ForbiddenIdentifiers: ['fooBar']
+      #   # bad (in all cases)
+      #   fooBar = 1
+      #   @fooBar = 1
+      #   @@fooBar = 1
+      #   $fooBar = 1
+      #
+      # @example ForbiddenPatterns: ['_v\d+\z']
+      #   # bad (in all cases)
+      #   release_v1 = true
+      #   @release_v1 = true
+      #   @@release_v1 = true
+      #   $release_v1 = true
       #
       class VariableName < Base
         include AllowedIdentifiers
         include ConfigurableNaming
         include AllowedPattern
+        include ForbiddenIdentifiers
+        include ForbiddenPattern
 
         MSG = 'Use %<style>s for variable names.'
+        MSG_FORBIDDEN = '`%<identifier>s` is forbidden, use another name instead.'
 
         def valid_name?(node, name, given_style = style)
           super || matches_allowed_pattern?(name)
         end
 
         def on_lvasgn(node)
-          name, = *node
-          return unless name
+          return unless (name = node.name)
           return if allowed_identifier?(name)
 
-          check_name(node, name, node.loc.name)
+          if forbidden_name?(name)
+            register_forbidden_name(node)
+          else
+            check_name(node, name, node.loc.name)
+          end
         end
         alias on_ivasgn    on_lvasgn
         alias on_cvasgn    on_lvasgn
@@ -57,11 +84,28 @@ module RuboCop
         alias on_blockarg  on_lvasgn
         alias on_lvar      on_lvasgn
 
+        # Only forbidden names are checked for global variable assignment
+        def on_gvasgn(node)
+          return unless (name = node.name)
+          return unless forbidden_name?(name)
+
+          register_forbidden_name(node)
+        end
+
         private
 
+        def forbidden_name?(name)
+          forbidden_identifier?(name) || forbidden_pattern?(name)
+        end
+
         def message(style)
           format(MSG, style: style)
         end
+
+        def register_forbidden_name(node)
+          message = format(MSG_FORBIDDEN, identifier: node.name)
+          add_offense(node.loc.name, message: message)
+        end
       end
     end
   end

data/lib/rubocop/cop/naming/variable_number.rb

@@ -113,10 +113,9 @@ module RuboCop
 
         def on_arg(node)
           @node = node
-          name, = *node
-          return if allowed_identifier?(name)
+          return if allowed_identifier?(node.name)
 
-          check_name(node, name, node.loc.name)
+          check_name(node, node.name, node.loc.name)
         end
         alias on_lvasgn on_arg
         alias on_ivasgn on_arg

data/lib/rubocop/cop/offense.rb

@@ -43,11 +43,10 @@ module RuboCop
       # @!attribute [r] cop_name
       #
       # @return [String]
-      #   a cop class name without department.
-      #   i.e. type of the violation.
+      #   the cop name as a String for which this offense is for.
       #
       # @example
-      #   'LineLength'
+      #   'Layout/LineLength'
       attr_reader :cop_name
 
       # @api private
@@ -97,8 +96,8 @@ module RuboCop
       # @!attribute [r] correctable?
       #
       # @return [Boolean]
-      #   whether this offense can be automatically corrected via
-      #   autocorrect or a todo.
+      #   whether this offense can be automatically corrected via autocorrect.
+      #   This includes todo comments, for example when requested with `--disable-uncorrectable`.
       def correctable?
         @status != :unsupported
       end

data/lib/rubocop/cop/registry.rb

@@ -23,8 +23,8 @@ module RuboCop
         global.without_department(:Test).cops
       end
 
-      def self.qualified_cop_name(name, origin)
-        global.qualified_cop_name(name, origin)
+      def self.qualified_cop_name(name, origin, warn: true)
+        global.qualified_cop_name(name, origin, warn: warn)
       end
 
       # Changes momentarily the global registry
@@ -139,7 +139,7 @@ module RuboCop
 
         case potential_badges.size
         when 0 then name # No namespace found. Deal with it later in caller.
-        when 1 then resolve_badge(badge, potential_badges.first, path)
+        when 1 then resolve_badge(badge, potential_badges.first, path, warn: warn)
         else raise AmbiguousCopName.new(badge, path, potential_badges)
         end
       end
@@ -296,11 +296,14 @@ module RuboCop
         self.class.new(cops)
       end
 
-      def resolve_badge(given_badge, real_badge, source_path)
+      def resolve_badge(given_badge, real_badge, source_path, warn: true)
         unless given_badge.match?(real_badge)
           path = PathUtil.smart_path(source_path)
-          warn "#{path}: #{given_badge} has the wrong namespace - " \
-               "should be #{real_badge.department}"
+
+          if warn
+            warn("#{path}: #{given_badge} has the wrong namespace - " \
+                 "replace it with #{given_badge.with_department(real_badge.department)}")
+          end
         end
 
         real_badge.to_s

data/lib/rubocop/cop/security/compound_hash.rb

@@ -30,8 +30,9 @@ module RuboCop
       class CompoundHash < Base
         COMBINATOR_IN_HASH_MSG = 'Use `[...].hash` instead of combining hash values manually.'
         MONUPLE_HASH_MSG =
-          'Delegate hash directly without wrapping in an array when only using a single value'
-        REDUNDANT_HASH_MSG = 'Calling .hash on elements of a hashed array is redundant'
+          'Delegate hash directly without wrapping in an array when only using a single value.'
+        REDUNDANT_HASH_MSG = 'Calling .hash on elements of a hashed array is redundant.'
+        RESTRICT_ON_SEND = %i[hash ^ + * |].freeze
 
         # @!method hash_method_definition?(node)
         def_node_matcher :hash_method_definition?, <<~PATTERN
@@ -99,6 +100,7 @@ module RuboCop
             add_offense(node, message: REDUNDANT_HASH_MSG)
           end
         end
+        alias on_csend on_send
         alias on_op_asgn on_send
       end
     end

data/lib/rubocop/cop/security/eval.rb

@@ -11,13 +11,14 @@ module RuboCop
       #
       #   eval(something)
       #   binding.eval(something)
+      #   Kernel.eval(something)
       class Eval < Base
         MSG = 'The use of `eval` is a serious security risk.'
         RESTRICT_ON_SEND = %i[eval].freeze
 
         # @!method eval?(node)
         def_node_matcher :eval?, <<~PATTERN
-          (send {nil? (send nil? :binding)} :eval $!str ...)
+          (send {nil? (send nil? :binding) (const {cbase nil?} :Kernel)} :eval $!str ...)
         PATTERN
 
         def on_send(node)

data/lib/rubocop/cop/security/json_load.rb

@@ -6,22 +6,40 @@ module RuboCop
       # Checks for the use of JSON class methods which have potential
       # security issues.
       #
+      # `JSON.load` and similar methods allow deserialization of arbitrary ruby objects:
+      #
+      # [source,ruby]
+      # ----
+      # require 'json/add/string'
+      # result = JSON.load('{ "json_class": "String", "raw": [72, 101, 108, 108, 111] }')
+      # pp result # => "Hello"
+      # ----
+      #
+      # Never use `JSON.load` for untrusted user input. Prefer `JSON.parse` unless you have
+      # a concrete use-case for `JSON.load`.
+      #
+      # NOTE: Starting with `json` gem version 2.8.0, triggering this behavior without explicitly
+      # passing the `create_additions` keyword argument emits a deprecation warning, with the
+      # goal of being secure by default in the next major version 3.0.0.
+      #
       # @safety
       #   This cop's autocorrection is unsafe because it's potentially dangerous.
-      #   If using a stream, like `JSON.load(open('file'))`, it will need to call
+      #   If using a stream, like `JSON.load(open('file'))`, you will need to call
       #   `#read` manually, like `JSON.parse(open('file').read)`.
-      #   If reading single values (rather than proper JSON objects), like
-      #   `JSON.load('false')`, it will need to pass the `quirks_mode: true`
-      #   option, like `JSON.parse('false', quirks_mode: true)`.
       #   Other similar issues may apply.
       #
       # @example
       #   # bad
-      #   JSON.load("{}")
-      #   JSON.restore("{}")
+      #   JSON.load('{}')
+      #   JSON.restore('{}')
       #
       #   # good
-      #   JSON.parse("{}")
+      #   JSON.parse('{}')
+      #   JSON.unsafe_load('{}')
+      #
+      #   # good - explicit use of `create_additions` option
+      #   JSON.load('{}', create_additions: true)
+      #   JSON.load('{}', create_additions: false)
       #
       class JSONLoad < Base
         extend AutoCorrector
@@ -29,13 +47,17 @@ module RuboCop
         MSG = 'Prefer `JSON.parse` over `JSON.%<method>s`.'
         RESTRICT_ON_SEND = %i[load restore].freeze
 
-        # @!method json_load(node)
-        def_node_matcher :json_load, <<~PATTERN
-          (send (const {nil? cbase} :JSON) ${:load :restore} ...)
+        # @!method insecure_json_load(node)
+        def_node_matcher :insecure_json_load, <<~PATTERN
+          (
+            send (const {nil? cbase} :JSON) ${:load :restore}
+            ...
+            !(hash `(sym $:create_additions))
+          )
         PATTERN
 
         def on_send(node)
-          json_load(node) do |method|
+          insecure_json_load(node) do |method|
             add_offense(node.loc.selector, message: format(MSG, method: method)) do |corrector|
               corrector.replace(node.loc.selector, 'parse')
             end

data/lib/rubocop/cop/security/open.rb

@@ -23,6 +23,7 @@ module RuboCop
       #   # bad
       #   open(something)
       #   open("| #{something}")
+      #   open("| foo")
       #   URI.open(something)
       #
       #   # good
@@ -32,15 +33,15 @@ module RuboCop
       #
       #   # good (literal strings)
       #   open("foo.text")
-      #   open("| foo")
       #   URI.open("http://example.com")
+      #   URI.parse(url).open
       class Open < Base
         MSG = 'The use of `%<receiver>sopen` is a serious security risk.'
         RESTRICT_ON_SEND = %i[open].freeze
 
         # @!method open?(node)
         def_node_matcher :open?, <<~PATTERN
-          (send ${nil? (const {nil? cbase} :URI)} :open $!str ...)
+          (send ${nil? (const {nil? cbase} :URI)} :open $_ ...)
         PATTERN
 
         def on_send(node)

data/lib/rubocop/cop/security/yaml_load.rb

@@ -25,18 +25,19 @@ module RuboCop
       #
       class YAMLLoad < Base
         extend AutoCorrector
+        extend TargetRubyVersion
 
         MSG = 'Prefer using `YAML.safe_load` over `YAML.load`.'
         RESTRICT_ON_SEND = %i[load].freeze
 
+        maximum_target_ruby_version 3.0
+
         # @!method yaml_load(node)
         def_node_matcher :yaml_load, <<~PATTERN
           (send (const {nil? cbase} :YAML) :load ...)
         PATTERN
 
         def on_send(node)
-          return if target_ruby_version >= 3.1
-
           yaml_load(node) do
             add_offense(node.loc.selector) do |corrector|
               corrector.replace(node.loc.selector, 'safe_load')