rubocop 1.71.1 → 1.91.0

data/lib/rubocop/cop/security/json_load.rb

@@ -6,22 +6,40 @@ module RuboCop
       # Checks for the use of JSON class methods which have potential
       # security issues.
       #
+      # `JSON.load` and similar methods allow deserialization of arbitrary ruby objects:
+      #
+      # [source,ruby]
+      # ----
+      # require 'json/add/string'
+      # result = JSON.load('{ "json_class": "String", "raw": [72, 101, 108, 108, 111] }')
+      # pp result # => "Hello"
+      # ----
+      #
+      # Never use `JSON.load` for untrusted user input. Prefer `JSON.parse` unless you have
+      # a concrete use-case for `JSON.load`.
+      #
+      # NOTE: Starting with `json` gem version 2.8.0, triggering this behavior without explicitly
+      # passing the `create_additions` keyword argument emits a deprecation warning, with the
+      # goal of being secure by default in the next major version 3.0.0.
+      #
       # @safety
       #   This cop's autocorrection is unsafe because it's potentially dangerous.
-      #   If using a stream, like `JSON.load(open('file'))`, it will need to call
+      #   If using a stream, like `JSON.load(open('file'))`, you will need to call
       #   `#read` manually, like `JSON.parse(open('file').read)`.
-      #   If reading single values (rather than proper JSON objects), like
-      #   `JSON.load('false')`, it will need to pass the `quirks_mode: true`
-      #   option, like `JSON.parse('false', quirks_mode: true)`.
       #   Other similar issues may apply.
       #
       # @example
       #   # bad
-      #   JSON.load("{}")
-      #   JSON.restore("{}")
+      #   JSON.load('{}')
+      #   JSON.restore('{}')
       #
       #   # good
-      #   JSON.parse("{}")
+      #   JSON.parse('{}')
+      #   JSON.unsafe_load('{}')
+      #
+      #   # good - explicit use of `create_additions` option
+      #   JSON.load('{}', create_additions: true)
+      #   JSON.load('{}', create_additions: false)
       #
       class JSONLoad < Base
         extend AutoCorrector
@@ -29,13 +47,17 @@ module RuboCop
         MSG = 'Prefer `JSON.parse` over `JSON.%<method>s`.'
         RESTRICT_ON_SEND = %i[load restore].freeze
 
-        # @!method json_load(node)
-        def_node_matcher :json_load, <<~PATTERN
-          (send (const {nil? cbase} :JSON) ${:load :restore} ...)
+        # @!method insecure_json_load(node)
+        def_node_matcher :insecure_json_load, <<~PATTERN
+          (
+            send (const {nil? cbase} :JSON) ${:load :restore}
+            ...
+            !`(pair (sym :create_additions) _)
+          )
         PATTERN
 
         def on_send(node)
-          json_load(node) do |method|
+          insecure_json_load(node) do |method|
             add_offense(node.loc.selector, message: format(MSG, method: method)) do |corrector|
               corrector.replace(node.loc.selector, 'parse')
             end

data/lib/rubocop/cop/security/marshal_load.rb

@@ -25,7 +25,7 @@ module RuboCop
         # @!method marshal_load(node)
         def_node_matcher :marshal_load, <<~PATTERN
           (send (const {nil? cbase} :Marshal) ${:load :restore}
-          !(send (const {nil? cbase} :Marshal) :dump ...))
+          !(send (const {nil? cbase} :Marshal) :dump ...) _?)
         PATTERN
 
         def on_send(node)

data/lib/rubocop/cop/security/open.rb

@@ -34,6 +34,7 @@ module RuboCop
       #   # good (literal strings)
       #   open("foo.text")
       #   URI.open("http://example.com")
+      #   URI.parse(url).open
       class Open < Base
         MSG = 'The use of `%<receiver>sopen` is a serious security risk.'
         RESTRICT_ON_SEND = %i[open].freeze

data/lib/rubocop/cop/security.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    # Cops for the `Security` department. The department's cops are registered for lazy loading
+    # and their files are loaded on demand.
+    module Security
+      extend LazyLoader
+
+      register_cop :CompoundHash, "#{__dir__}/security/compound_hash"
+      register_cop :Eval, "#{__dir__}/security/eval"
+      register_cop :IoMethods, "#{__dir__}/security/io_methods"
+      register_cop :JSONLoad, "#{__dir__}/security/json_load"
+      register_cop :MarshalLoad, "#{__dir__}/security/marshal_load"
+      register_cop :Open, "#{__dir__}/security/open"
+      register_cop :YAMLLoad, "#{__dir__}/security/yaml_load"
+    end
+  end
+end

data/lib/rubocop/cop/severity.rb

@@ -21,6 +21,18 @@ module RuboCop
       #   any of `:info`, `:refactor`, `:convention`, `:warning`, `:error` or `:fatal`.
       attr_reader :name
 
+      # The lowest severity that makes a run fail: `--fail-level` when given,
+      # otherwise `AllCops: FailLevel`. `autocorrect` is a pseudo level on the
+      # command line that gates on corrections instead, so it leaves the
+      # threshold at the configured one.
+      def self.minimum_to_fail(options, config)
+        name = options[:fail_level]
+        if name.nil? || name == :autocorrect
+          name = (config&.for_all_cops&.[]('FailLevel') || :refactor).to_sym
+        end
+        new(name)
+      end
+
       def self.name_from_code(code)
         name = code.to_sym
         CODE_TABLE[name] || name

data/lib/rubocop/cop/style/access_modifier_declarations.rb

@@ -195,15 +195,27 @@ module RuboCop
         def autocorrect(corrector, node)
           case style
           when :group
-            def_nodes = find_corresponding_def_nodes(node)
-            return unless def_nodes.any?
-
-            replace_defs(corrector, node, def_nodes)
+            autocorrect_group_style(corrector, node)
           when :inline
+            autocorrect_inline_style(corrector, node)
+          end
+        end
+
+        def autocorrect_group_style(corrector, node)
+          def_nodes = find_corresponding_def_nodes(node)
+          return unless def_nodes.any?
+
+          replace_defs(corrector, node, def_nodes)
+        end
+
+        def autocorrect_inline_style(corrector, node)
+          if node.parent&.begin_type?
+            remove_modifier_node_within_begin(corrector, node, node.parent)
+          else
             remove_nodes(corrector, node)
-            select_grouped_def_nodes(node).each do |grouped_def_node|
-              insert_inline_modifier(corrector, grouped_def_node, node.method_name)
-            end
+          end
+          select_grouped_def_nodes(node).each do |grouped_def_node|
+            insert_inline_modifier(corrector, grouped_def_node, node.method_name)
           end
         end
 
@@ -224,9 +236,13 @@ module RuboCop
         end
 
         def offense?(node)
-          (group_style? && access_modifier_is_inlined?(node) &&
-            !node.parent&.if_type? && !right_siblings_same_inline_method?(node)) ||
-            (inline_style? && access_modifier_is_not_inlined?(node))
+          if group_style?
+            return false if node.parent ? node.parent.if_type? : access_modifier_with_symbol?(node)
+
+            access_modifier_is_inlined?(node) && !right_siblings_same_inline_method?(node)
+          else
+            access_modifier_is_not_inlined?(node) && select_grouped_def_nodes(node).any?
+          end
         end
 
         def correctable_group_offense?(node)
@@ -300,7 +316,7 @@ module RuboCop
         end
 
         def select_grouped_def_nodes(node)
-          node.right_siblings.take_while do |sibling|
+          node.right_siblings.compact.take_while do |sibling|
             !(sibling.send_type? && sibling.bare_access_modifier_declaration?)
           end.select(&:def_type?)
         end
@@ -310,8 +326,7 @@ module RuboCop
           argument_less_modifier_node = find_argument_less_modifier_node(node)
           if argument_less_modifier_node
             corrector.insert_after(argument_less_modifier_node, "\n\n#{source}")
-          elsif (ancestor = node.each_ancestor(:class, :module).first)
-
+          elsif (ancestor = node.each_ancestor(:class, :module, :sclass).first)
             corrector.insert_before(ancestor.loc.end, "#{node.method_name}\n\n#{source}\n")
           else
             corrector.replace(node, "#{node.method_name}\n\n#{source}")
@@ -331,6 +346,25 @@ module RuboCop
           end
         end
 
+        def remove_modifier_node_within_begin(corrector, modifier_node, begin_node)
+          modifier_index = begin_node.children.find_index { |child| child.equal?(modifier_node) }
+          def_node = begin_node.children[modifier_index + 1]
+          # Stop the removal range at the first comment that precedes the def, if
+          # any exist. Without this, comments between the modifier and the def are
+          # dropped because they fall inside the removed range.
+          end_pos = first_comment_or_node_start(def_node)
+          corrector.remove(modifier_node.source_range.begin.join(end_pos))
+        end
+
+        def first_comment_or_node_start(node)
+          preceding = processed_source.ast_with_comments[node].select do |comment|
+            comment.loc.line < node.loc.line
+          end
+          return node.source_range.begin if preceding.empty?
+
+          preceding.first.source_range.begin
+        end
+
         def def_source(node, def_nodes)
           [
             *processed_source.ast_with_comments[node].map(&:text),

data/lib/rubocop/cop/style/accessor_grouping.rb

@@ -4,8 +4,10 @@ module RuboCop
   module Cop
     module Style
       # Checks for grouping of accessors in `class` and `module` bodies.
-      # By default it enforces accessors to be placed in grouped declarations,
-      # but it can be configured to enforce separating them in multiple declarations.
+      # By default it enforces accessors to be placed in grouped
+      # declarations, reducing boilerplate. It can also be configured
+      # to enforce separating them into individual declarations for
+      # easier diffing and per-attribute documentation.
       #
       # NOTE: If there is a method call before the accessor method it is always allowed
       # as it might be intended like Sorbet.
@@ -84,7 +86,10 @@ module RuboCop
 
         def autocorrect(corrector, node)
           if (preferred_accessors = preferred_accessors(node))
-            corrector.replace(node, preferred_accessors)
+            corrector.replace(
+              grouped_style? ? node : range_with_trailing_argument_comment(node),
+              preferred_accessors
+            )
           else
             range = range_with_surrounding_space(node.source_range, side: :left)
             corrector.remove(range)
@@ -95,7 +100,7 @@ module RuboCop
           comment_line?(processed_source[node.first_line - 2])
         end
 
-        # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+        # rubocop:disable-next Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
         def groupable_accessor?(node)
           return true unless (previous_expression = node.left_siblings.last)
 
@@ -117,7 +122,6 @@ module RuboCop
             previous_expression.access_modifier? ||
             node.first_line - previous_expression.last_line > 1 # there is a space between nodes
         end
-        # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
 
         def class_send_elements(class_node)
           class_def = class_node.body
@@ -139,12 +143,16 @@ module RuboCop
           style == :separated
         end
 
+        def groupable_sibling_accessor?(node, sibling)
+          sibling.attribute_accessor? &&
+            sibling.method?(node.method_name) &&
+            node_visibility(sibling) == node_visibility(node) &&
+            groupable_accessor?(sibling) && !previous_line_comment?(sibling)
+        end
+
         def groupable_sibling_accessors(send_node)
           send_node.parent.each_child_node(:send).select do |sibling|
-            sibling.attribute_accessor? &&
-              sibling.method?(send_node.method_name) &&
-              node_visibility(sibling) == node_visibility(send_node) &&
-              groupable_accessor?(sibling) && !previous_line_comment?(sibling)
+            groupable_sibling_accessor?(send_node, sibling)
           end
         end
 
@@ -155,13 +163,23 @@ module RuboCop
 
         def preferred_accessors(node)
           if grouped_style?
+            return if skip_for_grouping?(node)
+
             accessors = groupable_sibling_accessors(node)
-            group_accessors(node, accessors) if node.loc == accessors.first.loc
+            if node.loc == accessors.first.loc || skip_for_grouping?(accessors.first)
+              group_accessors(node, accessors)
+            end
           else
             separate_accessors(node)
           end
         end
 
+        # Group after constants
+        def skip_for_grouping?(node)
+          node.right_siblings.any?(&:casgn_type?) &&
+            node.right_siblings.any? { |n| n.send_type? && groupable_sibling_accessor?(node, n) }
+        end
+
         def group_accessors(node, accessors)
           accessor_names = accessors.flat_map { |accessor| accessor.arguments.map(&:source) }.uniq
 
@@ -182,6 +200,25 @@ module RuboCop
             end
           end.join("\n")
         end
+
+        def range_with_trailing_argument_comment(node)
+          comment = trailing_argument_comment(node)
+          if comment
+            add_range(node.source_range, comment.source_range)
+          else
+            node
+          end
+        end
+
+        # For a single-line declaration the parser associates the trailing
+        # comment with the first argument, not `last_argument`, so look through
+        # all arguments for a comment that trails the whole node.
+        def trailing_argument_comment(node)
+          comments = node.arguments.filter_map do |argument|
+            processed_source.ast_with_comments[argument].last
+          end
+          comments.find { |comment| comment.source_range.begin_pos >= node.source_range.end_pos }
+        end
       end
     end
   end

data/lib/rubocop/cop/style/alias.rb

@@ -4,10 +4,13 @@ module RuboCop
   module Cop
     module Style
       # Enforces the use of either `#alias` or `#alias_method`
-      # depending on configuration.
+      # depending on configuration. Consistent use of one or the
+      # other prevents confusion about their different semantics
+      # (e.g., `alias` is resolved at parse time, while `alias_method`
+      # is resolved at runtime).
       # It also flags uses of `alias :symbol` rather than `alias bareword`.
       #
-      # However, it will always enforce `method_alias` when used `alias`
+      # However, it will always enforce `alias_method` when `alias` is used
       # in an instance method definition and in a singleton method definition.
       # If used in a block, always enforce `alias_method`
       # unless it is an `instance_eval` block.
@@ -42,6 +45,7 @@ module RuboCop
           return unless node.command?(:alias_method)
           return unless style == :prefer_alias && alias_keyword_possible?(node)
           return unless node.arguments.count == 2
+          return if alias_method_value_used?(node)
 
           msg = format(MSG_ALIAS_METHOD, current: lexical_scope_type(node))
           add_offense(node.loc.selector, message: msg) do |corrector|
@@ -77,6 +81,14 @@ module RuboCop
           scope_type(node) != :dynamic && node.arguments.all?(&:sym_type?)
         end
 
+        # `alias_method` is a method call whose return value can be used
+        # (e.g., as an argument to `public`/`module_function`, or as an assignment),
+        # but `alias` is a keyword statement that cannot appear in such positions.
+        # Detect these positions so the conversion does not produce a syntax error.
+        def alias_method_value_used?(node)
+          node.argument? || node.parent&.assignment?
+        end
+
         def alias_method_possible?(node)
           scope_type(node) != :instance_eval &&
             node.children.none?(&:gvar_type?) &&
@@ -101,7 +113,7 @@ module RuboCop
               return :lexical
             when :def, :defs
               return :dynamic
-            when :block
+            when :block, :numblock, :itblock
               return :instance_eval if parent.method?(:instance_eval)
 
               return :dynamic

data/lib/rubocop/cop/style/and_or.rb

@@ -71,7 +71,7 @@ module RuboCop
             node.each_child_node do |expr|
               if expr.send_type?
                 correct_send(expr, corrector)
-              elsif expr.return_type? || expr.assignment?
+              elsif expr.type?(:return, :next, :break, :yield) || expr.assignment?
                 correct_other(expr, corrector)
               end
             end
@@ -128,6 +128,7 @@ module RuboCop
 
         def correct_other(node, corrector)
           return if node.parenthesized_call?
+          return if node.children.empty? && node.equal?(node.parent.children.last)
 
           corrector.wrap(node, '(', ')')
         end

data/lib/rubocop/cop/style/arguments_forwarding.rb

@@ -16,26 +16,26 @@ module RuboCop
       #
       # In Ruby 3.2, anonymous args/kwargs forwarding has been added.
       #
-      # This cop also identifies places where `use_args(*args)`/`use_kwargs(**kwargs)` can be
-      # replaced by `use_args(*)`/`use_kwargs(**)`; if desired, this functionality can be disabled
-      # by setting `UseAnonymousForwarding: false`.
+      # This cop also identifies places where `+use_args(*args)+`/`+use_kwargs(**kwargs)+` can be
+      # replaced by `+use_args(*)+`/`+use_kwargs(**)+`; if desired, this functionality can be
+      # disabled by setting `UseAnonymousForwarding: false`.
       #
       # And this cop has `RedundantRestArgumentNames`, `RedundantKeywordRestArgumentNames`,
       # and `RedundantBlockArgumentNames` options. This configuration is a list of redundant names
       # that are sufficient for anonymizing meaningless naming.
       #
       # Meaningless names that are commonly used can be anonymized by default:
-      # e.g., `*args`, `**options`, `&block`, and so on.
+      # e.g., `+*args+`, `+**options+`, `&block`, and so on.
       #
       # Names not on this list are likely to be meaningful and are allowed by default.
       #
       # This cop handles not only method forwarding but also forwarding to `super`.
       #
       # [NOTE]
-      # --
+      # ====
       # Because of a bug in Ruby 3.3.0, when a block is referenced inside of another block,
       # no offense will be registered until Ruby 3.4:
-
+      #
       # [source,ruby]
       # ----
       # def foo(&block)
@@ -43,7 +43,7 @@ module RuboCop
       #   block_method { bar(&block) }
       # end
       # ----
-      # --
+      # ====
       #
       # @example
       #   # bad
@@ -146,7 +146,6 @@ module RuboCop
         minimum_target_ruby_version 2.7
 
         FORWARDING_LVAR_TYPES = %i[splat kwsplat block_pass].freeze
-        ADDITIONAL_ARG_TYPES = %i[lvar arg].freeze
 
         FORWARDING_MSG = 'Use shorthand syntax `...` for arguments forwarding.'
         ARGS_MSG = 'Use anonymous positional arguments forwarding (`*`).'
@@ -154,7 +153,7 @@ module RuboCop
         BLOCK_MSG = 'Use anonymous block arguments forwarding (`&`).'
 
         def self.autocorrect_incompatible_with
-          [Naming::BlockForwarding]
+          [Naming::BlockForwarding, Style::MethodDefParentheses]
         end
 
         def on_def(node)
@@ -198,12 +197,12 @@ module RuboCop
           send_classifications.all? { |_, c, _, _| all_classifications.include?(c) }
         end
 
-        # rubocop:disable Metrics/MethodLength
+        # rubocop:disable-next Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
         def add_forward_all_offenses(node, send_classifications, forwardable_args)
-          _rest_arg, _kwrest_arg, block_arg = *forwardable_args
+          rest_arg, kwrest_arg, block_arg = *forwardable_args
           registered_block_arg_offense = false
 
-          send_classifications.each do |send_node, c, forward_rest, forward_kwrest, forward_block_arg| # rubocop:disable Layout/LineLength
+          send_classifications.each do |send_node, c, forward_rest, forward_kwrest, forward_block_arg| # rubocop:disable Layout/LineLength -- the block parameter list does not wrap
             if !forward_rest && !forward_kwrest && c != :all_anonymous
               if allow_anonymous_forwarding_in_block?(forward_block_arg)
                 register_forward_block_arg_offense(!forward_rest, node.arguments, block_arg)
@@ -212,25 +211,28 @@ module RuboCop
               registered_block_arg_offense = true
               break
             else
-              register_forward_all_offense(send_node, send_node, forward_rest)
+              first_arg = forward_rest || forward_kwrest || forward_all_first_argument(send_node)
+              register_forward_all_offense(send_node, send_node, first_arg)
             end
           end
 
           return if registered_block_arg_offense
 
-          rest_arg, _kwrest_arg, _block_arg = *forwardable_args
-          register_forward_all_offense(node, node.arguments, rest_arg)
+          register_forward_all_offense(node, node.arguments, rest_arg || kwrest_arg)
+        end
+
+        def forward_all_first_argument(node)
+          node.arguments.reverse_each.find(&:forwarded_restarg_type?)
         end
-        # rubocop:enable Metrics/MethodLength
 
-        # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+        # rubocop:disable-next Metrics/AbcSize, Metrics/MethodLength
         def add_post_ruby_32_offenses(def_node, send_classifications, forwardable_args)
           return unless use_anonymous_forwarding?
           return unless all_forwarding_offenses_correctable?(send_classifications)
 
           rest_arg, kwrest_arg, block_arg = *forwardable_args
 
-          send_classifications.each do |send_node, _c, forward_rest, forward_kwrest, forward_block_arg| # rubocop:disable Layout/LineLength
+          send_classifications.each do |send_node, _c, forward_rest, forward_kwrest, forward_block_arg| # rubocop:disable Layout/LineLength -- the block parameter list does not wrap
             if allow_anonymous_forwarding_in_block?(forward_rest)
               register_forward_args_offense(def_node.arguments, rest_arg)
               register_forward_args_offense(send_node, forward_rest)
@@ -247,7 +249,6 @@ module RuboCop
             end
           end
         end
-        # rubocop:enable Metrics/AbcSize, Metrics/MethodLength
 
         def non_splat_or_block_pass_lvar_references(body)
           body.each_descendant(:lvar, :lvasgn).filter_map do |lvar|
@@ -361,18 +362,9 @@ module RuboCop
           end
         end
 
-        # rubocop:disable Metrics/AbcSize
         def arguments_range(node, first_node)
-          arguments = node.arguments.reject do |arg|
-            next true if ADDITIONAL_ARG_TYPES.include?(arg.type) || arg.variable? || arg.call_type?
-
-            arg.literal? && arg.each_descendant(:kwsplat).none?
-          end
-
-          start_node = first_node || arguments.first
-          start_node.source_range.begin.join(arguments.last.source_range.end)
+          first_node.source_range.begin.join(node.last_argument.source_range.end)
         end
-        # rubocop:enable Metrics/AbcSize
 
         def allow_only_rest_arguments?
           cop_config.fetch('AllowOnlyRestArgument', true)
@@ -430,21 +422,39 @@ module RuboCop
           end
 
           def forwarded_rest_arg
-            return nil if referenced_rest_arg?
+            return @forwarded_rest_arg if defined?(@forwarded_rest_arg)
 
-            arguments.find { |arg| forwarded_rest_arg?(arg, @rest_arg_name) }
+            @forwarded_rest_arg = if referenced_rest_arg?
+                                    nil
+                                  else
+                                    arguments.find do |arg|
+                                      forwarded_rest_arg?(arg, @rest_arg_name)
+                                    end
+                                  end
           end
 
           def forwarded_kwrest_arg
-            return nil if referenced_kwrest_arg?
+            return @forwarded_kwrest_arg if defined?(@forwarded_kwrest_arg)
 
-            arguments.filter_map { |arg| extract_forwarded_kwrest_arg(arg, @kwrest_arg_name) }.first
+            @forwarded_kwrest_arg = if referenced_kwrest_arg?
+                                      nil
+                                    else
+                                      arguments.filter_map do |arg|
+                                        extract_forwarded_kwrest_arg(arg, @kwrest_arg_name)
+                                      end.first
+                                    end
           end
 
           def forwarded_block_arg
-            return nil if referenced_block_arg?
+            return @forwarded_block_arg if defined?(@forwarded_block_arg)
 
-            arguments.find { |arg| forwarded_block_arg?(arg, @block_arg_name) }
+            @forwarded_block_arg = if referenced_block_arg?
+                                     nil
+                                   else
+                                     arguments.find do |arg|
+                                       forwarded_block_arg?(arg, @block_arg_name)
+                                     end
+                                   end
           end
 
           def classification
@@ -461,7 +471,7 @@ module RuboCop
 
           private
 
-          # rubocop:disable Metrics/CyclomaticComplexity
+          # rubocop:disable-next Metrics/CyclomaticComplexity
           def can_forward_all?
             return false if any_arg_referenced?
             return false if ruby_30_or_lower_optarg?
@@ -471,7 +481,6 @@ module RuboCop
 
             no_additional_args? || (target_ruby_version >= 3.0 && no_post_splat_args?)
           end
-          # rubocop:enable Metrics/CyclomaticComplexity
 
           # def foo(a = 41, ...) is a syntax error in 3.0.
           def ruby_30_or_lower_optarg?
@@ -479,6 +488,9 @@ module RuboCop
           end
 
           def ruby_32_only_anonymous_forwarding?
+            # A block argument and an anonymous block argument are never passed together.
+            return false if @send_node.each_ancestor(:any_block).any?
+
             def_all_anonymous_args?(@def_node) && send_all_anonymous_args?(@send_node)
           end
 

data/lib/rubocop/cop/style/array_first_last.rb

@@ -31,7 +31,7 @@ module RuboCop
         MSG = 'Use `%<preferred>s`.'
         RESTRICT_ON_SEND = %i[[]].freeze
 
-        # rubocop:disable Metrics/AbcSize
+        # rubocop:disable-next Metrics/AbcSize
         def on_send(node)
           return unless node.arguments.size == 1 && node.first_argument.int_type?
 
@@ -40,19 +40,23 @@ module RuboCop
 
           node = innermost_braces_node(node)
           return if node.parent && brace_method?(node.parent)
+          return if compound_assignment_target?(node)
 
-          preferred = (value.zero? ? 'first' : 'last')
+          preferred = preferred_name(value)
           offense_range = find_offense_range(node)
 
           add_offense(offense_range, message: format(MSG, preferred: preferred)) do |corrector|
             corrector.replace(offense_range, preferred_value(node, preferred))
           end
         end
-        # rubocop:enable Metrics/AbcSize
         alias on_csend on_send
 
         private
 
+        def preferred_name(value)
+          value.zero? ? 'first' : 'last'
+        end
+
         def preferred_value(node, value)
           value = ".#{value}" unless node.loc.dot
           value
@@ -74,6 +78,12 @@ module RuboCop
         def brace_method?(node)
           node.send_type? && (node.method?(:[]) || node.method?(:[]=))
         end
+
+        # `arr[0] += 1` etc. would autocorrect to `arr.first += 1`, which calls the
+        # nonexistent `first=`/`last=` setter and raises `NoMethodError`.
+        def compound_assignment_target?(node)
+          node.parent&.type?(:op_asgn, :or_asgn, :and_asgn) && node.parent.children.first == node
+        end
       end
     end
   end