rubocop 1.71.1 → 1.92.0

data/lib/rubocop/cop/registry.rb

@@ -16,15 +16,15 @@ module RuboCop
     end
 
     # Registry that tracks all cops by their badge and department.
-    class Registry
+    class Registry # rubocop:disable Metrics/ClassLength
       include Enumerable
 
       def self.all
         global.without_department(:Test).cops
       end
 
-      def self.qualified_cop_name(name, origin)
-        global.qualified_cop_name(name, origin)
+      def self.qualified_cop_name(name, origin, warn: true, correct_namespace: true)
+        global.qualified_cop_name(name, origin, warn: warn, correct_namespace: correct_namespace)
       end
 
       # Changes momentarily the global registry
@@ -43,21 +43,44 @@ module RuboCop
 
       def self.qualified_cop?(name)
         badge = Badge.parse(name)
-        global.qualify_badge(badge).first == badge
+        global.qualify_badge(badge).include?(badge)
       end
 
-      attr_reader :options
+      attr_reader :options, :warnings
 
       def initialize(cops = [], options = {})
-        @registry = {}
-        @departments = {}
-        @cops_by_cop_name = Hash.new { |hash, key| hash[key] = [] }
+        @departments = Set.new
+        # Maps each badge to its cop class, or to the fully qualified constant name (a `String`)
+        # when the cop is registered for lazy loading and its file is not loaded yet.
+        # A single insertion-ordered map keeps the registration order stable no matter when
+        # a lazy-loaded cop's file gets loaded, because reassigning an existing key preserves
+        # its position; the cop execution order depends on this order.
+        @cops_by_badge = {}
 
         @enrollment_queue = cops
         @options = options
 
         @enabled_cache = {}.compare_by_identity
         @disabled_cache = {}.compare_by_identity
+        @disabled_names_cache = {}.compare_by_identity
+        @warnings = {}
+      end
+
+      # Registers a cop by its badge and constant name without loading the class.
+      # The constant is resolved (loading the cop's file through `autoload`) only
+      # when the cop class itself is needed.
+      #
+      # @param badge [Badge, String] the badge, or the qualified cop name
+      # @param constant_name [String] the fully qualified constant name
+      def lazy_load(badge, constant_name)
+        badge = Badge.parse(badge) if badge.is_a?(String)
+
+        # File any cops enlisted earlier first, so that the registration
+        # order follows the call order.
+        clear_enrollment_queue
+
+        @departments << badge.department
+        @cops_by_badge[badge] = constant_name unless @cops_by_badge[badge].is_a?(Class)
       end
 
       def enlist(cop)
@@ -65,28 +88,46 @@ module RuboCop
       end
 
       def dismiss(cop)
-        raise "Cop #{cop} could not be dismissed" unless @enrollment_queue.delete(cop)
+        dismissed = !@enrollment_queue.delete(cop).nil?
+
+        # A lazy-loaded cop that was not enlisted yet is dismissed by removing its registration.
+        # Anonymous cop classes cannot have a badge.
+        if !cop.name.nil? && @cops_by_badge[cop.badge].is_a?(String)
+          @cops_by_badge.delete(cop.badge)
+          dismissed = true
+        end
+
+        raise "Cop #{cop} could not be dismissed" unless dismissed
       end
 
       # @return [Array<Symbol>] list of departments for current cops.
       def departments
         clear_enrollment_queue
-        @departments.keys
+        @departments.to_a
       end
 
       # @return [Registry] Cops for that specific department.
       def with_department(department)
-        clear_enrollment_queue
-        with(@departments.fetch(department, []))
+        filter_by_badge { |badge| badge.department == department }
       end
 
       # @return [Registry] Cops not for a specific department.
       def without_department(department)
-        clear_enrollment_queue
-        without_department = @departments.dup
-        without_department.delete(department)
+        filter_by_badge { |badge| badge.department != department }
+      end
 
-        with(without_department.values.flatten)
+      # Returns a new registry containing the cops whose badge satisfies the given block,
+      # keeping lazy-loaded cops unloaded.
+      #
+      # @api private
+      # @return [Registry]
+      def filter_by_badge(options = {})
+        clear_enrollment_queue
+        copy = self.class.new([], options)
+        @cops_by_badge.each do |badge, cop_or_name|
+          copy.add_entry(badge, cop_or_name) if yield(badge)
+        end
+        copy
       end
 
       # @return [Boolean] Checks if given name is department
@@ -95,7 +136,7 @@ module RuboCop
       end
 
       def contains_cop_matching?(names)
-        cops.any? { |cop| cop.match?(names) }
+        registered_badges.any? { |badge| badge.match_name?(names) }
       end
 
       # Convert a user provided cop name into a properly namespaced name
@@ -130,16 +171,24 @@ module RuboCop
       # @note Emits a warning if the provided name has an incorrect namespace
       #
       # @return [String] Qualified cop name
-      def qualified_cop_name(name, path, warn: true)
+      def qualified_cop_name(name, path, warn: true, correct_namespace: true)
         badge = Badge.parse(name)
-        print_warning(name, path) if warn && department_missing?(badge, name)
+        print_department_missing_warning(name, path) if warn && department_missing?(badge, name)
         return name if registered?(badge)
+        # A name qualified with the wrong department is returned as is when
+        # namespace correction is not wanted, so the caller can surface the
+        # mistake instead of silently acting on the corrected name.
+        return name if badge.qualified? && !correct_namespace
+
+        resolve_cop_name(badge, name, path, warn)
+      end
 
+      def resolve_cop_name(badge, name, path, warn)
         potential_badges = qualify_badge(badge)
 
         case potential_badges.size
         when 0 then name # No namespace found. Deal with it later in caller.
-        when 1 then resolve_badge(badge, potential_badges.first, path)
+        when 1 then resolve_badge(badge, potential_badges.first, path, warn: warn)
         else raise AmbiguousCopName.new(badge, path, potential_badges)
         end
       end
@@ -148,85 +197,108 @@ module RuboCop
         !badge.qualified? && unqualified_cop_names.include?(name)
       end
 
-      def print_warning(name, path)
-        message = "#{path}: Warning: no department given for #{name}."
+      def print_department_missing_warning(name, path)
+        message = "no department given for #{name}."
         if path.end_with?('.rb')
           message += ' Run `rubocop -a --only Migration/DepartmentName` to fix.'
         end
-        warn message
+        emit_warning(path, message)
       end
 
       def unqualified_cop_names
         clear_enrollment_queue
-        @unqualified_cop_names ||=
-          Set.new(@cops_by_cop_name.keys.map { |qn| File.basename(qn) }) <<
-          'RedundantCopDisableDirective'
+
+        @unqualified_cop_names ||= @cops_by_badge.keys.to_set do |badge|
+          File.basename(badge.to_s)
+        end << 'RedundantCopDisableDirective'
       end
 
       def qualify_badge(badge)
         clear_enrollment_queue
         @departments
-          .map { |department, _| badge.with_department(department) }
+          .map { |department| badge.with_department(department) }
           .select { |potential_badge| registered?(potential_badge) }
       end
 
       # @return [Hash{String => Array<Class>}]
       def to_h
         clear_enrollment_queue
-        @cops_by_cop_name
+        load_all_lazy_cops
+        @cops_by_badge.to_h { |_badge, cop| [cop.cop_name, [cop]] }
       end
 
       def cops
         clear_enrollment_queue
-        @registry.values
+        load_all_lazy_cops
+        @cops_by_badge.values
       end
 
       def length
         clear_enrollment_queue
-        @registry.size
+        @cops_by_badge.size
       end
 
+      # Returns the enabled cop classes, loading lazy-loaded cops only when they are enabled.
+      #
+      # @return [Array<Class>]
       def enabled(config)
-        @enabled_cache[config] ||= select { |cop| enabled?(cop, config) }
+        @enabled_cache[config] ||= registered_badges.filter_map do |badge|
+          next unless enabled_cop_name?(badge.to_s, config)
+
+          cop_or_name = @cops_by_badge[badge]
+          cop_or_name.is_a?(String) ? load_lazy_cop(badge) : cop_or_name
+        end
       end
 
       def disabled(config)
         @disabled_cache[config] ||= reject { |cop| enabled?(cop, config) }
       end
 
-      def enabled?(cop, config)
-        return true if options[:only]&.include?(cop.cop_name)
-
-        # We need to use `cop_name` in this case, because `for_cop` uses caching
-        # which expects cop names or cop classes as keys.
-        cfg = config.for_cop(cop.cop_name)
-
-        cop_enabled = cfg.fetch('Enabled') == true || enabled_pending_cop?(cfg, config)
-
-        if options.fetch(:safe, false)
-          cop_enabled && cfg.fetch('Safe', true)
-        else
-          cop_enabled
+      # Returns the names of the disabled cops without loading any of them.
+      #
+      # @api private
+      # @return [Array<String>]
+      def disabled_names(config)
+        @disabled_names_cache[config] ||= registered_badges.filter_map do |badge|
+          name = badge.to_s
+          name unless enabled_cop_name?(name, config)
         end
       end
 
-      def enabled_pending_cop?(cop_cfg, config)
+      def enabled?(cop, config)
+        enabled_cop_name?(cop.cop_name, config)
+      end
+
+      # @param cop [Class, String, nil] the cop class or the qualified cop name
+      def enabled_pending_cop?(cop_cfg, config, cop = nil)
         return false if @options[:disable_pending_cops]
+        return false unless cop_cfg.fetch('Enabled') == 'pending'
+        return true if @options[:enable_pending_cops]
+        return config.enabled_new_cops? unless cop
+
+        cop_name = cop.is_a?(String) ? cop : cop.cop_name
+        config.enabled_new_cop?(cop_name)
+      end
 
-        cop_cfg.fetch('Enabled') == 'pending' &&
-          (@options[:enable_pending_cops] || config.enabled_new_cops?)
+      # Preview cops are opt-in and stay silent otherwise, so unlike pending cops
+      # they are never reported as needing a decision.
+      def enabled_preview_cop?(cop_cfg, config)
+        cop_cfg.fetch('Enabled') == 'preview' && config.preview?(@options)
       end
 
       def names
-        cops.map(&:cop_name)
+        clear_enrollment_queue
+        @cops_by_badge.keys.map(&:to_s)
       end
 
       def cops_for_department(department)
-        cops.select { |cop| cop.department == department.to_sym }
+        with_department(department.to_sym).cops
       end
 
       def names_for_department(department)
-        cops_for_department(department).map(&:cop_name)
+        department = department.to_sym
+
+        registered_badges.filter_map { |badge| badge.to_s if badge.department == department }
       end
 
       def ==(other)
@@ -235,7 +307,8 @@ module RuboCop
 
       def sort!
         clear_enrollment_queue
-        @registry = @registry.sort_by { |badge, _| badge.cop_name }.to_h
+        load_all_lazy_cops
+        @cops_by_badge = @cops_by_badge.sort_by { |badge, _cop| badge.cop_name }.to_h
 
         self
       end
@@ -251,7 +324,11 @@ module RuboCop
       # @param [String] cop_name
       # @return [Class, nil]
       def find_by_cop_name(cop_name)
-        to_h[cop_name].first
+        clear_enrollment_queue
+        badge = Badge.parse(cop_name)
+        cop_or_name = @cops_by_badge[badge]
+
+        cop_or_name.is_a?(String) ? load_lazy_cop(badge) : cop_or_name
       end
 
       # When a cop name is given returns a single-element array with the cop class.
@@ -262,9 +339,33 @@ module RuboCop
         cop ? [cop] : cops_for_department(directive)
       end
 
+      # Loads all cops that are registered for lazy loading. Useful when lazily registered cops
+      # must not outlive the current global registry, e.g. before a temporary global registry is
+      # discarded in tests.
+      #
+      # @api private
+      def load_all_lazy_cops
+        # Take a snapshot because loading a cop can load (and thereby register)
+        # another lazy-loaded cop, e.g. its superclass.
+        badges = @cops_by_badge.keys
+
+        badges.each do |badge|
+          load_lazy_cop(badge) if @cops_by_badge[badge].is_a?(String)
+        end
+      end
+
       def freeze
         clear_enrollment_queue
+        load_all_lazy_cops
         unqualified_cop_names # build cache
+
+        # Freeze the structural collections as well, so that a cop class defined after
+        # the freeze fails fast at its `enlist`/`lazy_load` call site instead of corrupting
+        # the registry and failing much later.
+        @cops_by_badge.freeze
+        @departments.freeze
+        @enrollment_queue.freeze
+
         super
       end
 
@@ -274,41 +375,109 @@ module RuboCop
         attr_reader :global
       end
 
+      def warnings?(path)
+        @warnings[path]
+      end
+
+      protected
+
+      # Adds an already-loaded cop class or a lazy-load constant name under the given badge,
+      # used to build filtered copies.
+      def add_entry(badge, cop_or_name)
+        @departments << badge.department
+        @cops_by_badge[badge] = cop_or_name
+      end
+
       private
 
       def initialize_copy(reg)
-        initialize(reg.cops, reg.options)
+        super
+        @cops_by_badge = @cops_by_badge.dup
+        @enrollment_queue = @enrollment_queue.dup
+        @departments = @departments.dup
+        @enabled_cache = {}.compare_by_identity
+        @disabled_cache = {}.compare_by_identity
+        @disabled_names_cache = {}.compare_by_identity
+        @warnings = {}
+        @unqualified_cop_names = nil
       end
 
       def clear_enrollment_queue
         return if @enrollment_queue.empty?
 
         @enrollment_queue.each do |cop|
-          @registry[cop.badge] = cop
-          @departments[cop.department] ||= []
-          @departments[cop.department] << cop
-          @cops_by_cop_name[cop.cop_name] << cop
+          # Reassigning a badge that was registered for lazy loading keeps
+          # its original position in the insertion-ordered map.
+          @cops_by_badge[cop.badge] = cop
+          @departments << cop.department
         end
         @enrollment_queue = []
       end
 
-      def with(cops)
-        self.class.new(cops)
+      def registered_badges
+        clear_enrollment_queue
+        @cops_by_badge.keys
       end
 
-      def resolve_badge(given_badge, real_badge, source_path)
-        unless given_badge.match?(real_badge)
-          path = PathUtil.smart_path(source_path)
-          warn "#{path}: #{given_badge} has the wrong namespace - " \
-               "replace it with #{given_badge.with_department(real_badge.department)}"
+      def enabled_cop_name?(cop_name, config)
+        return true if options[:only]&.include?(cop_name)
+
+        # We need to use the cop name in this case, because `for_cop` uses
+        # caching which expects cop names or cop classes as keys.
+        cfg = config.for_cop(cop_name)
+
+        cop_enabled = cfg.fetch('Enabled') == true ||
+                      enabled_pending_cop?(cfg, config, cop_name) ||
+                      enabled_preview_cop?(cfg, config)
+
+        if options.fetch(:safe, false)
+          cop_enabled && cfg.fetch('Safe', true)
+        else
+          cop_enabled
+        end
+      end
+
+      # @return [Class, nil] the loaded cop class, or nil if the cop excluded
+      #   itself from the registry while being loaded
+      def load_lazy_cop(badge)
+        constant_name = @cops_by_badge[badge]
+        return constant_name unless constant_name.is_a?(String)
+
+        cop = Kernel.const_get(constant_name)
+        if equal?(self.class.global)
+          # Resolving the constant fires the autoload, which makes
+          # `Base.inherited` enlist the class into the global registry.
+          # Enrolling through the queue keeps `exclude_from_registry` honored:
+          # a cop that dismissed itself leaves a dangling constant name behind
+          # and is removed from the registry.
+          clear_enrollment_queue
+          cop_or_name = @cops_by_badge[badge]
+          @cops_by_badge.delete(badge) if cop_or_name.is_a?(String)
+          cop_or_name.is_a?(Class) ? cop_or_name : nil
+        else
+          # `Base.inherited` enlists into the global registry, not this copy.
+          @cops_by_badge[badge] = cop
+        end
+      end
+
+      def resolve_badge(given_badge, real_badge, source_path, warn: true)
+        if warn && !given_badge.match?(real_badge)
+          emit_warning(source_path,
+                       "#{given_badge} has the wrong namespace - " \
+                       "replace it with #{given_badge.with_department(real_badge.department)}")
         end
 
         real_badge.to_s
       end
 
+      def emit_warning(path, message)
+        Registry.global.warnings[path] = true
+        warn "#{PathUtil.smart_path(path)}: Warning: #{message}"
+      end
+
       def registered?(badge)
         clear_enrollment_queue
-        @registry.key?(badge)
+        @cops_by_badge.key?(badge)
       end
     end
   end

data/lib/rubocop/cop/security/eval.rb

@@ -3,21 +3,35 @@
 module RuboCop
   module Cop
     module Security
-      # Checks for the use of `Kernel#eval` and `Binding#eval`.
+      # Checks for the use of `Kernel#eval` and `Binding#eval` with
+      # dynamic strings as arguments. Evaluating non-literal strings
+      # can enable code injection attacks and makes it difficult to
+      # reason about what code will actually be executed.
+      #
+      # Calls to `eval` with literal strings are not flagged by this cop,
+      # as they do not pose the same injection risk.
       #
       # @example
       #
       #   # bad
-      #
       #   eval(something)
       #   binding.eval(something)
+      #   Kernel.eval(something)
+      #
+      #   # good - use safer alternatives
+      #   obj.public_send(method_name)
+      #   obj.send(method_name, *args)
+      #
+      #   # good - literal strings are allowed
+      #   eval("1 + 1")
+      #   binding.eval("foo")
       class Eval < Base
         MSG = 'The use of `eval` is a serious security risk.'
         RESTRICT_ON_SEND = %i[eval].freeze
 
         # @!method eval?(node)
         def_node_matcher :eval?, <<~PATTERN
-          (send {nil? (send nil? :binding)} :eval $!str ...)
+          (send {nil? (send nil? :binding) (const {cbase nil?} :Kernel)} :eval $!str ...)
         PATTERN
 
         def on_send(node)

data/lib/rubocop/cop/security/io_methods.rb

@@ -10,7 +10,7 @@ module RuboCop
       # a subprocess is created in the same way as `Kernel#open`, and its output is returned.
       # `Kernel#open` may allow unintentional command injection, which is the reason these
       # `IO` methods are a security risk.
-      # Consider to use `File.read` to disable the behavior of subprocess invocation.
+      # Consider using `File.read` to disable the behavior of subprocess invocation.
       #
       # @safety
       #   This cop is unsafe because false positive will occur if the variable passed as
@@ -37,7 +37,7 @@ module RuboCop
           return unless (receiver = node.receiver) && receiver.source == 'IO'
 
           argument = node.first_argument
-          return if argument.respond_to?(:value) && argument.value.strip.start_with?('|')
+          return if argument&.str_type? && argument.value.strip.start_with?('|')
 
           add_offense(node, message: format(MSG, method_name: node.method_name)) do |corrector|
             corrector.replace(receiver, 'File')

data/lib/rubocop/cop/security/json_load.rb

@@ -6,22 +6,50 @@ module RuboCop
       # Checks for the use of JSON class methods which have potential
       # security issues.
       #
+      # `JSON.load` and similar methods allow deserialization of arbitrary ruby objects:
+      #
+      # [source,ruby]
+      # ----
+      # require 'json/add/string'
+      # result = JSON.load('{ "json_class": "String", "raw": [72, 101, 108, 108, 111] }')
+      # pp result # => "Hello"
+      # ----
+      #
+      # Never use `JSON.load` for untrusted user input. Prefer `JSON.parse` unless you have
+      # a concrete use-case for `JSON.load`.
+      #
+      # NOTE: Starting with `json` gem version 2.8.0, triggering this behavior without explicitly
+      # passing the `create_additions` keyword argument emits a deprecation warning, with the
+      # goal of being secure by default in the next major version 3.0.0.
+      #
+      # NOTE: Before `json` gem version 2.17.0, `JSON.load` only takes options as its third
+      # argument. A hash passed as the second argument is taken as the `proc` argument, so
+      # its `create_additions` option is ignored. Which `json` version runs can't be told
+      # statically (the lockfile may resolve a newer one than the default gem loaded in
+      # production), so options passed as the second argument are always reported. Pass
+      # `nil` as the second argument instead.
+      #
       # @safety
       #   This cop's autocorrection is unsafe because it's potentially dangerous.
-      #   If using a stream, like `JSON.load(open('file'))`, it will need to call
+      #   If using a stream, like `JSON.load(open('file'))`, you will need to call
       #   `#read` manually, like `JSON.parse(open('file').read)`.
-      #   If reading single values (rather than proper JSON objects), like
-      #   `JSON.load('false')`, it will need to pass the `quirks_mode: true`
-      #   option, like `JSON.parse('false', quirks_mode: true)`.
       #   Other similar issues may apply.
       #
       # @example
       #   # bad
-      #   JSON.load("{}")
-      #   JSON.restore("{}")
+      #   JSON.load('{}')
+      #   JSON.restore('{}')
+      #
+      #   # bad - ignored by `json` older than 2.17.0
+      #   JSON.load('{}', create_additions: false)
       #
       #   # good
-      #   JSON.parse("{}")
+      #   JSON.parse('{}')
+      #   JSON.unsafe_load('{}')
+      #
+      #   # good - explicit use of `create_additions` option
+      #   JSON.load('{}', nil, create_additions: true)
+      #   JSON.load('{}', nil, create_additions: false)
       #
       class JSONLoad < Base
         extend AutoCorrector
@@ -29,13 +57,19 @@ module RuboCop
         MSG = 'Prefer `JSON.parse` over `JSON.%<method>s`.'
         RESTRICT_ON_SEND = %i[load restore].freeze
 
-        # @!method json_load(node)
-        def_node_matcher :json_load, <<~PATTERN
-          (send (const {nil? cbase} :JSON) ${:load :restore} ...)
+        # @!method insecure_json_load(node)
+        def_node_matcher :insecure_json_load, <<~PATTERN
+          (
+            send (const {nil? cbase} :JSON) ${:load :restore}
+            {
+              _ hash
+            | ... !`(pair (sym :create_additions) _)
+            }
+          )
         PATTERN
 
         def on_send(node)
-          json_load(node) do |method|
+          insecure_json_load(node) do |method|
             add_offense(node.loc.selector, message: format(MSG, method: method)) do |corrector|
               corrector.replace(node.loc.selector, 'parse')
             end

data/lib/rubocop/cop/security/marshal_load.rb

@@ -25,7 +25,7 @@ module RuboCop
         # @!method marshal_load(node)
         def_node_matcher :marshal_load, <<~PATTERN
           (send (const {nil? cbase} :Marshal) ${:load :restore}
-          !(send (const {nil? cbase} :Marshal) :dump ...))
+          !(send (const {nil? cbase} :Marshal) :dump ...) _?)
         PATTERN
 
         def on_send(node)

data/lib/rubocop/cop/security/open.rb

@@ -34,6 +34,7 @@ module RuboCop
       #   # good (literal strings)
       #   open("foo.text")
       #   URI.open("http://example.com")
+      #   URI.parse(url).open
       class Open < Base
         MSG = 'The use of `%<receiver>sopen` is a serious security risk.'
         RESTRICT_ON_SEND = %i[open].freeze

data/lib/rubocop/cop/security.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    # Cops for the `Security` department. The department's cops are registered for lazy loading
+    # and their files are loaded on demand.
+    module Security
+      extend LazyLoader
+
+      register_cop :CompoundHash, "#{__dir__}/security/compound_hash"
+      register_cop :Eval, "#{__dir__}/security/eval"
+      register_cop :IoMethods, "#{__dir__}/security/io_methods"
+      register_cop :JSONLoad, "#{__dir__}/security/json_load"
+      register_cop :MarshalLoad, "#{__dir__}/security/marshal_load"
+      register_cop :Open, "#{__dir__}/security/open"
+      register_cop :YAMLLoad, "#{__dir__}/security/yaml_load"
+    end
+  end
+end

data/lib/rubocop/cop/severity.rb

@@ -21,6 +21,18 @@ module RuboCop
       #   any of `:info`, `:refactor`, `:convention`, `:warning`, `:error` or `:fatal`.
       attr_reader :name
 
+      # The lowest severity that makes a run fail: `--fail-level` when given,
+      # otherwise `AllCops: FailLevel`. `autocorrect` is a pseudo level on the
+      # command line that gates on corrections instead, so it leaves the
+      # threshold at the configured one.
+      def self.minimum_to_fail(options, config)
+        name = options[:fail_level]
+        if name.nil? || name == :autocorrect
+          name = (config&.for_all_cops&.[]('FailLevel') || :refactor).to_sym
+        end
+        new(name)
+      end
+
       def self.name_from_code(code)
         name = code.to_sym
         CODE_TABLE[name] || name