rubocop 1.67.0 → 1.81.6

data/lib/rubocop/cop/naming/rescued_exceptions_variable_name.rb

@@ -109,11 +109,11 @@ module RuboCop
               variable_name_matches?(lvasgn_node, name)
             end
           else
-            node.children.first == name
+            node.name == name
           end
         end
 
-        # rubocop:disable Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
+        # rubocop:disable Metrics/MethodLength
         def correct_node(corrector, node, offending_name, preferred_name)
           return unless node
 
@@ -129,24 +129,19 @@ module RuboCop
               end
             end
 
-            if child_node.masgn_type? || child_node.lvasgn_type?
+            if child_node.type?(:masgn, :lvasgn)
               correct_reassignment(corrector, child_node, offending_name, preferred_name)
               break
             end
           end
         end
-        # rubocop:enable Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
+        # rubocop:enable Metrics/MethodLength
 
         # If the exception variable is reassigned, that assignment needs to be corrected.
         # Further `lvar` nodes will not be corrected though since they now refer to a
         # different variable.
         def correct_reassignment(corrector, node, offending_name, preferred_name)
-          if node.lvasgn_type?
-            correct_node(corrector, node.child_nodes.first, offending_name, preferred_name)
-          elsif node.masgn_type?
-            # With multiple assign, the assignments are in an array as the last child
-            correct_node(corrector, node.children.last, offending_name, preferred_name)
-          end
+          correct_node(corrector, node.rhs, offending_name, preferred_name)
         end
 
         def preferred_name(variable_name)
@@ -159,10 +154,7 @@ module RuboCop
         end
 
         def variable_name(node)
-          asgn_node = node.exception_variable
-          return unless asgn_node
-
-          asgn_node.children.last
+          node.exception_variable.name if node.exception_variable.respond_to?(:name)
         end
 
         def message(node)

data/lib/rubocop/cop/naming/variable_name.rb

@@ -3,8 +3,15 @@
 module RuboCop
   module Cop
     module Naming
-      # Makes sure that all variables use the configured style,
-      # snake_case or camelCase, for their names.
+      # Checks that the configured style (snake_case or camelCase) is used for all variable names.
+      # This includes local variables, instance variables, class variables, method arguments
+      # (positional, keyword, rest or block), and block arguments.
+      #
+      # The cop can also be configured to forbid using specific names for variables, using
+      # `ForbiddenIdentifiers` or `ForbiddenPatterns`. In addition to the above, this applies
+      # to global variables as well.
+      #
+      # Method definitions and method calls are not affected by this cop.
       #
       # @example EnforcedStyle: snake_case (default)
       #   # bad
@@ -26,25 +33,45 @@ module RuboCop
       #
       # @example AllowedPatterns: ['_v\d+\z']
       #   # good (with EnforcedStyle: camelCase)
-      #   :release_v1
+      #   release_v1 = true
+      #
+      # @example ForbiddenIdentifiers: ['fooBar']
+      #   # bad (in all cases)
+      #   fooBar = 1
+      #   @fooBar = 1
+      #   @@fooBar = 1
+      #   $fooBar = 1
+      #
+      # @example ForbiddenPatterns: ['_v\d+\z']
+      #   # bad (in all cases)
+      #   release_v1 = true
+      #   @release_v1 = true
+      #   @@release_v1 = true
+      #   $release_v1 = true
       #
       class VariableName < Base
         include AllowedIdentifiers
         include ConfigurableNaming
         include AllowedPattern
+        include ForbiddenIdentifiers
+        include ForbiddenPattern
 
         MSG = 'Use %<style>s for variable names.'
+        MSG_FORBIDDEN = '`%<identifier>s` is forbidden, use another name instead.'
 
         def valid_name?(node, name, given_style = style)
           super || matches_allowed_pattern?(name)
         end
 
         def on_lvasgn(node)
-          name, = *node
-          return unless name
+          return unless (name = node.name)
           return if allowed_identifier?(name)
 
-          check_name(node, name, node.loc.name)
+          if forbidden_name?(name)
+            register_forbidden_name(node)
+          else
+            check_name(node, name, node.loc.name)
+          end
         end
         alias on_ivasgn    on_lvasgn
         alias on_cvasgn    on_lvasgn
@@ -57,11 +84,28 @@ module RuboCop
         alias on_blockarg  on_lvasgn
         alias on_lvar      on_lvasgn
 
+        # Only forbidden names are checked for global variable assignment
+        def on_gvasgn(node)
+          return unless (name = node.name)
+          return unless forbidden_name?(name)
+
+          register_forbidden_name(node)
+        end
+
         private
 
+        def forbidden_name?(name)
+          forbidden_identifier?(name) || forbidden_pattern?(name)
+        end
+
         def message(style)
           format(MSG, style: style)
         end
+
+        def register_forbidden_name(node)
+          message = format(MSG_FORBIDDEN, identifier: node.name)
+          add_offense(node.loc.name, message: message)
+        end
       end
     end
   end

data/lib/rubocop/cop/naming/variable_number.rb

@@ -113,10 +113,9 @@ module RuboCop
 
         def on_arg(node)
           @node = node
-          name, = *node
-          return if allowed_identifier?(name)
+          return if allowed_identifier?(node.name)
 
-          check_name(node, name, node.loc.name)
+          check_name(node, node.name, node.loc.name)
         end
         alias on_lvasgn on_arg
         alias on_ivasgn on_arg

data/lib/rubocop/cop/offense.rb

@@ -43,11 +43,10 @@ module RuboCop
       # @!attribute [r] cop_name
       #
       # @return [String]
-      #   a cop class name without department.
-      #   i.e. type of the violation.
+      #   the cop name as a String for which this offense is for.
       #
       # @example
-      #   'LineLength'
+      #   'Layout/LineLength'
       attr_reader :cop_name
 
       # @api private

data/lib/rubocop/cop/registry.rb

@@ -23,8 +23,8 @@ module RuboCop
         global.without_department(:Test).cops
       end
 
-      def self.qualified_cop_name(name, origin)
-        global.qualified_cop_name(name, origin)
+      def self.qualified_cop_name(name, origin, warn: true)
+        global.qualified_cop_name(name, origin, warn: warn)
       end
 
       # Changes momentarily the global registry
@@ -139,7 +139,7 @@ module RuboCop
 
         case potential_badges.size
         when 0 then name # No namespace found. Deal with it later in caller.
-        when 1 then resolve_badge(badge, potential_badges.first, path)
+        when 1 then resolve_badge(badge, potential_badges.first, path, warn: warn)
         else raise AmbiguousCopName.new(badge, path, potential_badges)
         end
       end
@@ -296,11 +296,14 @@ module RuboCop
         self.class.new(cops)
       end
 
-      def resolve_badge(given_badge, real_badge, source_path)
+      def resolve_badge(given_badge, real_badge, source_path, warn: true)
         unless given_badge.match?(real_badge)
           path = PathUtil.smart_path(source_path)
-          warn "#{path}: #{given_badge} has the wrong namespace - " \
-               "replace it with #{given_badge.with_department(real_badge.department)}"
+
+          if warn
+            warn("#{path}: #{given_badge} has the wrong namespace - " \
+                 "replace it with #{given_badge.with_department(real_badge.department)}")
+          end
         end
 
         real_badge.to_s

data/lib/rubocop/cop/security/compound_hash.rb

@@ -32,6 +32,7 @@ module RuboCop
         MONUPLE_HASH_MSG =
           'Delegate hash directly without wrapping in an array when only using a single value.'
         REDUNDANT_HASH_MSG = 'Calling .hash on elements of a hashed array is redundant.'
+        RESTRICT_ON_SEND = %i[hash ^ + * |].freeze
 
         # @!method hash_method_definition?(node)
         def_node_matcher :hash_method_definition?, <<~PATTERN
@@ -99,6 +100,7 @@ module RuboCop
             add_offense(node, message: REDUNDANT_HASH_MSG)
           end
         end
+        alias on_csend on_send
         alias on_op_asgn on_send
       end
     end

data/lib/rubocop/cop/security/eval.rb

@@ -11,13 +11,14 @@ module RuboCop
       #
       #   eval(something)
       #   binding.eval(something)
+      #   Kernel.eval(something)
       class Eval < Base
         MSG = 'The use of `eval` is a serious security risk.'
         RESTRICT_ON_SEND = %i[eval].freeze
 
         # @!method eval?(node)
         def_node_matcher :eval?, <<~PATTERN
-          (send {nil? (send nil? :binding)} :eval $!str ...)
+          (send {nil? (send nil? :binding) (const {cbase nil?} :Kernel)} :eval $!str ...)
         PATTERN
 
         def on_send(node)

data/lib/rubocop/cop/security/json_load.rb

@@ -6,22 +6,40 @@ module RuboCop
       # Checks for the use of JSON class methods which have potential
       # security issues.
       #
+      # `JSON.load` and similar methods allow deserialization of arbitrary ruby objects:
+      #
+      # [source,ruby]
+      # ----
+      # require 'json/add/string'
+      # result = JSON.load('{ "json_class": "String", "raw": [72, 101, 108, 108, 111] }')
+      # pp result # => "Hello"
+      # ----
+      #
+      # Never use `JSON.load` for untrusted user input. Prefer `JSON.parse` unless you have
+      # a concrete use-case for `JSON.load`.
+      #
+      # NOTE: Starting with `json` gem version 2.8.0, triggering this behavior without explicitly
+      # passing the `create_additions` keyword argument emits a deprecation warning, with the
+      # goal of being secure by default in the next major version 3.0.0.
+      #
       # @safety
       #   This cop's autocorrection is unsafe because it's potentially dangerous.
-      #   If using a stream, like `JSON.load(open('file'))`, it will need to call
+      #   If using a stream, like `JSON.load(open('file'))`, you will need to call
       #   `#read` manually, like `JSON.parse(open('file').read)`.
-      #   If reading single values (rather than proper JSON objects), like
-      #   `JSON.load('false')`, it will need to pass the `quirks_mode: true`
-      #   option, like `JSON.parse('false', quirks_mode: true)`.
       #   Other similar issues may apply.
       #
       # @example
       #   # bad
-      #   JSON.load("{}")
-      #   JSON.restore("{}")
+      #   JSON.load('{}')
+      #   JSON.restore('{}')
       #
       #   # good
-      #   JSON.parse("{}")
+      #   JSON.parse('{}')
+      #   JSON.unsafe_load('{}')
+      #
+      #   # good - explicit use of `create_additions` option
+      #   JSON.load('{}', create_additions: true)
+      #   JSON.load('{}', create_additions: false)
       #
       class JSONLoad < Base
         extend AutoCorrector
@@ -29,13 +47,17 @@ module RuboCop
         MSG = 'Prefer `JSON.parse` over `JSON.%<method>s`.'
         RESTRICT_ON_SEND = %i[load restore].freeze
 
-        # @!method json_load(node)
-        def_node_matcher :json_load, <<~PATTERN
-          (send (const {nil? cbase} :JSON) ${:load :restore} ...)
+        # @!method insecure_json_load(node)
+        def_node_matcher :insecure_json_load, <<~PATTERN
+          (
+            send (const {nil? cbase} :JSON) ${:load :restore}
+            ...
+            !(hash `(sym $:create_additions))
+          )
         PATTERN
 
         def on_send(node)
-          json_load(node) do |method|
+          insecure_json_load(node) do |method|
             add_offense(node.loc.selector, message: format(MSG, method: method)) do |corrector|
               corrector.replace(node.loc.selector, 'parse')
             end

data/lib/rubocop/cop/security/open.rb

@@ -34,6 +34,7 @@ module RuboCop
       #   # good (literal strings)
       #   open("foo.text")
       #   URI.open("http://example.com")
+      #   URI.parse(url).open
       class Open < Base
         MSG = 'The use of `%<receiver>sopen` is a serious security risk.'
         RESTRICT_ON_SEND = %i[open].freeze

data/lib/rubocop/cop/security/yaml_load.rb

@@ -25,18 +25,19 @@ module RuboCop
       #
       class YAMLLoad < Base
         extend AutoCorrector
+        extend TargetRubyVersion
 
         MSG = 'Prefer using `YAML.safe_load` over `YAML.load`.'
         RESTRICT_ON_SEND = %i[load].freeze
 
+        maximum_target_ruby_version 3.0
+
         # @!method yaml_load(node)
         def_node_matcher :yaml_load, <<~PATTERN
           (send (const {nil? cbase} :YAML) :load ...)
         PATTERN
 
         def on_send(node)
-          return if target_ruby_version >= 3.1
-
           yaml_load(node) do
             add_offense(node.loc.selector) do |corrector|
               corrector.replace(node.loc.selector, 'safe_load')

data/lib/rubocop/cop/style/access_modifier_declarations.rb

@@ -70,6 +70,7 @@ module RuboCop
       #     private :bar, :baz
       #     private *%i[qux quux]
       #     private *METHOD_NAMES
+      #     private *private_methods
       #
       #   end
       #
@@ -80,6 +81,7 @@ module RuboCop
       #     private :bar, :baz
       #     private *%i[qux quux]
       #     private *METHOD_NAMES
+      #     private *private_methods
       #
       #   end
       #
@@ -110,6 +112,26 @@ module RuboCop
       #     private attr :quux
       #
       #   end
+      #
+      # @example AllowModifiersOnAliasMethod: true (default)
+      #   # good
+      #   class Foo
+      #
+      #     public alias_method :bar, :foo
+      #     protected alias_method :baz, :foo
+      #     private alias_method :qux, :foo
+      #
+      #   end
+      #
+      # @example AllowModifiersOnAliasMethod: false
+      #   # bad
+      #   class Foo
+      #
+      #     public alias_method :bar, :foo
+      #     protected alias_method :baz, :foo
+      #     private alias_method :qux, :foo
+      #
+      #   end
       class AccessModifierDeclarations < Base
         extend AutoCorrector
 
@@ -128,26 +150,27 @@ module RuboCop
 
         RESTRICT_ON_SEND = %i[private protected public module_function].freeze
 
-        ALLOWED_NODE_TYPES = %i[pair block].freeze
-
         # @!method access_modifier_with_symbol?(node)
         def_node_matcher :access_modifier_with_symbol?, <<~PATTERN
           (send nil? {:private :protected :public :module_function}
-            {(sym _) (splat {#percent_symbol_array? const})}
+            {(sym _)+ (splat {#percent_symbol_array? const send})}
           )
         PATTERN
 
         # @!method access_modifier_with_attr?(node)
         def_node_matcher :access_modifier_with_attr?, <<~PATTERN
           (send nil? {:private :protected :public :module_function}
-            (send nil? {:attr :attr_reader :attr_writer :attr_accessor} _))
+            (send nil? {:attr :attr_reader :attr_writer :attr_accessor} _+))
+        PATTERN
+
+        # @!method access_modifier_with_alias_method?, <<~PATTERN
+        def_node_matcher :access_modifier_with_alias_method?, <<~PATTERN
+          (send nil? {:private :protected :public :module_function}
+            (send nil? :alias_method _ _))
         PATTERN
 
         def on_send(node)
-          return unless node.access_modifier?
-          return if ALLOWED_NODE_TYPES.include?(node.parent&.type)
-          return if allow_modifiers_on_symbols?(node)
-          return if allow_modifiers_on_attrs?(node)
+          return if allowed?(node)
 
           if offense?(node)
             add_offense(node.loc.selector) do |corrector|
@@ -161,18 +184,38 @@ module RuboCop
 
         private
 
+        def allowed?(node)
+          !node.access_modifier? ||
+            node.parent&.type?(:pair, :any_block) ||
+            allow_modifiers_on_symbols?(node) ||
+            allow_modifiers_on_attrs?(node) ||
+            allow_modifiers_on_alias_method?(node)
+        end
+
         def autocorrect(corrector, node)
           case style
           when :group
-            def_node = find_corresponding_def_node(node)
-            return unless def_node
-
-            replace_def(corrector, node, def_node)
+            autocorrect_group_style(corrector, node)
           when :inline
-            remove_node(corrector, node)
-            select_grouped_def_nodes(node).each do |grouped_def_node|
-              insert_inline_modifier(corrector, grouped_def_node, node.method_name)
-            end
+            autocorrect_inline_style(corrector, node)
+          end
+        end
+
+        def autocorrect_group_style(corrector, node)
+          def_nodes = find_corresponding_def_nodes(node)
+          return unless def_nodes.any?
+
+          replace_defs(corrector, node, def_nodes)
+        end
+
+        def autocorrect_inline_style(corrector, node)
+          if node.parent&.begin_type?
+            remove_modifier_node_within_begin(corrector, node, node.parent)
+          else
+            remove_nodes(corrector, node)
+          end
+          select_grouped_def_nodes(node).each do |grouped_def_node|
+            insert_inline_modifier(corrector, grouped_def_node, node.method_name)
           end
         end
 
@@ -188,10 +231,25 @@ module RuboCop
           cop_config['AllowModifiersOnAttrs'] && access_modifier_with_attr?(node)
         end
 
+        def allow_modifiers_on_alias_method?(node)
+          cop_config['AllowModifiersOnAliasMethod'] && access_modifier_with_alias_method?(node)
+        end
+
         def offense?(node)
-          (group_style? && access_modifier_is_inlined?(node) &&
-            !right_siblings_same_inline_method?(node)) ||
-            (inline_style? && access_modifier_is_not_inlined?(node))
+          if group_style?
+            return false if node.parent ? node.parent.if_type? : access_modifier_with_symbol?(node)
+
+            access_modifier_is_inlined?(node) && !right_siblings_same_inline_method?(node)
+          else
+            access_modifier_is_not_inlined?(node) && select_grouped_def_nodes(node).any?
+          end
+        end
+
+        def correctable_group_offense?(node)
+          return false unless group_style?
+          return false if allowed?(node)
+
+          access_modifier_is_inlined?(node) && find_corresponding_def_nodes(node).any?
         end
 
         def group_style?
@@ -212,7 +270,11 @@ module RuboCop
 
         def right_siblings_same_inline_method?(node)
           node.right_siblings.any? do |sibling|
-            sibling.send_type? && sibling.method?(node.method_name) && !sibling.arguments.empty?
+            sibling.send_type? &&
+              correctable_group_offense?(sibling) &&
+              sibling.method?(node.method_name) &&
+              !sibling.arguments.empty? &&
+              find_corresponding_def_nodes(sibling).any?
           end
         end
 
@@ -226,14 +288,22 @@ module RuboCop
           end
         end
 
-        def find_corresponding_def_node(node)
+        def find_corresponding_def_nodes(node)
           if access_modifier_with_symbol?(node)
-            method_name = node.first_argument.respond_to?(:value) && node.first_argument.value
-            node.parent.each_child_node(:def).find do |child|
-              child.method?(method_name)
+            method_names = node.arguments.filter_map do |argument|
+              next unless argument.sym_type?
+
+              argument.respond_to?(:value) && argument.value
             end
+
+            def_nodes = node.parent.each_child_node(:def).select do |child|
+              method_names.include?(child.method_name)
+            end
+
+            # If there isn't a `def` node for each symbol, we will skip autocorrection.
+            def_nodes.size == method_names.size ? def_nodes : []
           else
-            node.first_argument
+            [node.first_argument]
           end
         end
 
@@ -251,12 +321,12 @@ module RuboCop
           end.select(&:def_type?)
         end
 
-        def replace_def(corrector, node, def_node)
-          source = def_source(node, def_node)
+        def replace_defs(corrector, node, def_nodes)
+          source = def_source(node, def_nodes)
           argument_less_modifier_node = find_argument_less_modifier_node(node)
           if argument_less_modifier_node
             corrector.insert_after(argument_less_modifier_node, "\n\n#{source}")
-          elsif (ancestor = node.each_ancestor(:block, :class, :module).first)
+          elsif (ancestor = node.each_ancestor(:class, :module).first)
 
             corrector.insert_before(ancestor.loc.end, "#{node.method_name}\n\n#{source}\n")
           else
@@ -264,20 +334,30 @@ module RuboCop
             return
           end
 
-          remove_node(corrector, def_node)
-          remove_node(corrector, node)
+          remove_nodes(corrector, *def_nodes, node)
         end
 
         def insert_inline_modifier(corrector, node, modifier_name)
           corrector.insert_before(node, "#{modifier_name} ")
         end
 
-        def remove_node(corrector, node)
-          corrector.remove(range_with_comments_and_lines(node))
+        def remove_nodes(corrector, *nodes)
+          nodes.each do |node|
+            corrector.remove(range_with_comments_and_lines(node))
+          end
+        end
+
+        def remove_modifier_node_within_begin(corrector, modifier_node, begin_node)
+          def_node = begin_node.children[begin_node.children.index(modifier_node) + 1]
+          range = modifier_node.source_range.begin.join(def_node.source_range.begin)
+          corrector.remove(range)
         end
 
-        def def_source(node, def_node)
-          [*processed_source.ast_with_comments[node].map(&:text), def_node.source].join("\n")
+        def def_source(node, def_nodes)
+          [
+            *processed_source.ast_with_comments[node].map(&:text),
+            *def_nodes.map(&:source)
+          ].join("\n")
         end
       end
     end

data/lib/rubocop/cop/style/accessor_grouping.rb

@@ -84,7 +84,10 @@ module RuboCop
 
         def autocorrect(corrector, node)
           if (preferred_accessors = preferred_accessors(node))
-            corrector.replace(node, preferred_accessors)
+            corrector.replace(
+              grouped_style? ? node : range_with_trailing_argument_comment(node),
+              preferred_accessors
+            )
           else
             range = range_with_surrounding_space(node.source_range, side: :left)
             corrector.remove(range)
@@ -139,12 +142,16 @@ module RuboCop
           style == :separated
         end
 
+        def groupable_sibling_accessor?(node, sibling)
+          sibling.attribute_accessor? &&
+            sibling.method?(node.method_name) &&
+            node_visibility(sibling) == node_visibility(node) &&
+            groupable_accessor?(sibling) && !previous_line_comment?(sibling)
+        end
+
         def groupable_sibling_accessors(send_node)
           send_node.parent.each_child_node(:send).select do |sibling|
-            sibling.attribute_accessor? &&
-              sibling.method?(send_node.method_name) &&
-              node_visibility(sibling) == node_visibility(send_node) &&
-              groupable_accessor?(sibling) && !previous_line_comment?(sibling)
+            groupable_sibling_accessor?(send_node, sibling)
           end
         end
 
@@ -155,13 +162,23 @@ module RuboCop
 
         def preferred_accessors(node)
           if grouped_style?
+            return if skip_for_grouping?(node)
+
             accessors = groupable_sibling_accessors(node)
-            group_accessors(node, accessors) if node.loc == accessors.first.loc
+            if node.loc == accessors.first.loc || skip_for_grouping?(accessors.first)
+              group_accessors(node, accessors)
+            end
           else
             separate_accessors(node)
           end
         end
 
+        # Group after constants
+        def skip_for_grouping?(node)
+          node.right_siblings.any?(&:casgn_type?) &&
+            node.right_siblings.any? { |n| n.send_type? && groupable_sibling_accessor?(node, n) }
+        end
+
         def group_accessors(node, accessors)
           accessor_names = accessors.flat_map { |accessor| accessor.arguments.map(&:source) }.uniq
 
@@ -182,6 +199,15 @@ module RuboCop
             end
           end.join("\n")
         end
+
+        def range_with_trailing_argument_comment(node)
+          comment = processed_source.ast_with_comments[node.last_argument].last
+          if comment
+            add_range(node.source_range, comment.source_range)
+          else
+            node
+          end
+        end
       end
     end
   end