rubocop 1.75.8 → 1.81.7

data/lib/rubocop/cop/security/json_load.rb

@@ -6,22 +6,40 @@ module RuboCop
       # Checks for the use of JSON class methods which have potential
       # security issues.
       #
+      # `JSON.load` and similar methods allow deserialization of arbitrary ruby objects:
+      #
+      # [source,ruby]
+      # ----
+      # require 'json/add/string'
+      # result = JSON.load('{ "json_class": "String", "raw": [72, 101, 108, 108, 111] }')
+      # pp result # => "Hello"
+      # ----
+      #
+      # Never use `JSON.load` for untrusted user input. Prefer `JSON.parse` unless you have
+      # a concrete use-case for `JSON.load`.
+      #
+      # NOTE: Starting with `json` gem version 2.8.0, triggering this behavior without explicitly
+      # passing the `create_additions` keyword argument emits a deprecation warning, with the
+      # goal of being secure by default in the next major version 3.0.0.
+      #
       # @safety
       #   This cop's autocorrection is unsafe because it's potentially dangerous.
-      #   If using a stream, like `JSON.load(open('file'))`, it will need to call
+      #   If using a stream, like `JSON.load(open('file'))`, you will need to call
       #   `#read` manually, like `JSON.parse(open('file').read)`.
-      #   If reading single values (rather than proper JSON objects), like
-      #   `JSON.load('false')`, it will need to pass the `quirks_mode: true`
-      #   option, like `JSON.parse('false', quirks_mode: true)`.
       #   Other similar issues may apply.
       #
       # @example
       #   # bad
-      #   JSON.load("{}")
-      #   JSON.restore("{}")
+      #   JSON.load('{}')
+      #   JSON.restore('{}')
       #
       #   # good
-      #   JSON.parse("{}")
+      #   JSON.parse('{}')
+      #   JSON.unsafe_load('{}')
+      #
+      #   # good - explicit use of `create_additions` option
+      #   JSON.load('{}', create_additions: true)
+      #   JSON.load('{}', create_additions: false)
       #
       class JSONLoad < Base
         extend AutoCorrector
@@ -29,13 +47,17 @@ module RuboCop
         MSG = 'Prefer `JSON.parse` over `JSON.%<method>s`.'
         RESTRICT_ON_SEND = %i[load restore].freeze
 
-        # @!method json_load(node)
-        def_node_matcher :json_load, <<~PATTERN
-          (send (const {nil? cbase} :JSON) ${:load :restore} ...)
+        # @!method insecure_json_load(node)
+        def_node_matcher :insecure_json_load, <<~PATTERN
+          (
+            send (const {nil? cbase} :JSON) ${:load :restore}
+            ...
+            !(hash `(sym $:create_additions))
+          )
         PATTERN
 
         def on_send(node)
-          json_load(node) do |method|
+          insecure_json_load(node) do |method|
             add_offense(node.loc.selector, message: format(MSG, method: method)) do |corrector|
               corrector.replace(node.loc.selector, 'parse')
             end

data/lib/rubocop/cop/security/open.rb

@@ -34,6 +34,7 @@ module RuboCop
       #   # good (literal strings)
       #   open("foo.text")
       #   URI.open("http://example.com")
+      #   URI.parse(url).open
       class Open < Base
         MSG = 'The use of `%<receiver>sopen` is a serious security risk.'
         RESTRICT_ON_SEND = %i[open].freeze

data/lib/rubocop/cop/style/access_modifier_declarations.rb

@@ -348,7 +348,7 @@ module RuboCop
         end
 
         def remove_modifier_node_within_begin(corrector, modifier_node, begin_node)
-          def_node = begin_node.children[1]
+          def_node = begin_node.children[begin_node.children.index(modifier_node) + 1]
           range = modifier_node.source_range.begin.join(def_node.source_range.begin)
           corrector.remove(range)
         end

data/lib/rubocop/cop/style/accessor_grouping.rb

@@ -84,7 +84,10 @@ module RuboCop
 
         def autocorrect(corrector, node)
           if (preferred_accessors = preferred_accessors(node))
-            corrector.replace(node, preferred_accessors)
+            corrector.replace(
+              grouped_style? ? node : range_with_trailing_argument_comment(node),
+              preferred_accessors
+            )
           else
             range = range_with_surrounding_space(node.source_range, side: :left)
             corrector.remove(range)
@@ -196,6 +199,15 @@ module RuboCop
             end
           end.join("\n")
         end
+
+        def range_with_trailing_argument_comment(node)
+          comment = processed_source.ast_with_comments[node.last_argument].last
+          if comment
+            add_range(node.source_range, comment.source_range)
+          else
+            node
+          end
+        end
       end
     end
   end

data/lib/rubocop/cop/style/arguments_forwarding.rb

@@ -146,7 +146,6 @@ module RuboCop
         minimum_target_ruby_version 2.7
 
         FORWARDING_LVAR_TYPES = %i[splat kwsplat block_pass].freeze
-        ADDITIONAL_ARG_TYPES = %i[lvar arg optarg].freeze
 
         FORWARDING_MSG = 'Use shorthand syntax `...` for arguments forwarding.'
         ARGS_MSG = 'Use anonymous positional arguments forwarding (`*`).'
@@ -198,9 +197,9 @@ module RuboCop
           send_classifications.all? { |_, c, _, _| all_classifications.include?(c) }
         end
 
-        # rubocop:disable Metrics/MethodLength
+        # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
         def add_forward_all_offenses(node, send_classifications, forwardable_args)
-          _rest_arg, _kwrest_arg, block_arg = *forwardable_args
+          rest_arg, kwrest_arg, block_arg = *forwardable_args
           registered_block_arg_offense = false
 
           send_classifications.each do |send_node, c, forward_rest, forward_kwrest, forward_block_arg| # rubocop:disable Layout/LineLength
@@ -212,16 +211,20 @@ module RuboCop
               registered_block_arg_offense = true
               break
             else
-              register_forward_all_offense(send_node, send_node, forward_rest)
+              first_arg = forward_rest || forward_kwrest || forward_all_first_argument(send_node)
+              register_forward_all_offense(send_node, send_node, first_arg)
             end
           end
 
           return if registered_block_arg_offense
 
-          rest_arg, _kwrest_arg, _block_arg = *forwardable_args
-          register_forward_all_offense(node, node.arguments, rest_arg)
+          register_forward_all_offense(node, node.arguments, rest_arg || kwrest_arg)
+        end
+        # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
+
+        def forward_all_first_argument(node)
+          node.arguments.reverse_each.find(&:forwarded_restarg_type?)
         end
-        # rubocop:enable Metrics/MethodLength
 
         # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
         def add_post_ruby_32_offenses(def_node, send_classifications, forwardable_args)
@@ -361,18 +364,9 @@ module RuboCop
           end
         end
 
-        # rubocop:disable Metrics/AbcSize
         def arguments_range(node, first_node)
-          arguments = node.arguments.reject do |arg|
-            next true if ADDITIONAL_ARG_TYPES.include?(arg.type) || arg.variable? || arg.call_type?
-
-            arg.literal? && arg.each_descendant(:kwsplat).none?
-          end
-
-          start_node = first_node || arguments.first
-          start_node.source_range.begin.join(arguments.last.source_range.end)
+          first_node.source_range.begin.join(node.last_argument.source_range.end)
         end
-        # rubocop:enable Metrics/AbcSize
 
         def allow_only_rest_arguments?
           cop_config.fetch('AllowOnlyRestArgument', true)

data/lib/rubocop/cop/style/array_intersect.rb

@@ -5,12 +5,17 @@ module RuboCop
     module Style
       # In Ruby 3.1, `Array#intersect?` has been added.
       #
-      # This cop identifies places where `(array1 & array2).any?`
-      # or `(array1.intersection(array2)).any?` can be replaced by
-      # `array1.intersect?(array2)`.
+      # This cop identifies places where:
       #
-      # The `array1.intersect?(array2)` method is faster than
-      # `(array1 & array2).any?` and is more readable.
+      # * `(array1 & array2).any?`
+      # * `(array1.intersection(array2)).any?`
+      # * `array1.any? { |elem| array2.member?(elem) }`
+      # * `(array1 & array2).count > 0`
+      # * `(array1 & array2).size > 0`
+      #
+      # can be replaced with `array1.intersect?(array2)`.
+      #
+      # `array1.intersect?(array2)` is faster and more readable.
       #
       # In cases like the following, compatibility is not ensured,
       # so it will not be detected when using block argument.
@@ -40,10 +45,27 @@ module RuboCop
       #   array1.intersection(array2).empty?
       #   array1.intersection(array2).none?
       #
+      #   # bad
+      #   array1.any? { |elem| array2.member?(elem) }
+      #   array1.none? { |elem| array2.member?(elem) }
+      #
       #   # good
       #   array1.intersect?(array2)
       #   !array1.intersect?(array2)
       #
+      #   # bad
+      #   (array1 & array2).count > 0
+      #   (array1 & array2).count.positive?
+      #   (array1 & array2).count != 0
+      #
+      #   (array1 & array2).count == 0
+      #   (array1 & array2).count.zero?
+      #
+      #   # good
+      #   array1.intersect?(array2)
+      #
+      #   !array1.intersect?(array2)
+      #
       # @example AllCops:ActiveSupportExtensionsEnabled: false (default)
       #   # good
       #   (array1 & array2).present?
@@ -66,64 +88,106 @@ module RuboCop
         PREDICATES = %i[any? empty? none?].to_set.freeze
         ACTIVE_SUPPORT_PREDICATES = (PREDICATES + %i[present? blank?]).freeze
 
+        ARRAY_SIZE_METHODS = %i[count length size].to_set.freeze
+
         # @!method bad_intersection_check?(node, predicates)
         def_node_matcher :bad_intersection_check?, <<~PATTERN
-          (call
+          $(call
             {
               (begin (send $_ :& $_))
-              (call $_ :intersection $_)
+              (call $!nil? :intersection $_)
             }
             $%1
           )
         PATTERN
 
-        MSG = 'Use `%<negated>s%<receiver>s%<dot>sintersect?(%<argument>s)` ' \
-              'instead of `%<existing>s`.'
-        STRAIGHT_METHODS = %i[present? any?].freeze
-        NEGATED_METHODS = %i[blank? empty? none?].freeze
+        # @!method intersection_size_check?(node, predicates)
+        def_node_matcher :intersection_size_check?, <<~PATTERN
+          (call
+            $(call
+              {
+                (begin (send $_ :& $_))
+                (call $!nil? :intersection $_)
+              }
+              %ARRAY_SIZE_METHODS
+            )
+            {$:> (int 0) | $:positive? | $:!= (int 0) | $:== (int 0) | $:zero?}
+          )
+        PATTERN
+
+        # @!method any_none_block_intersection(node)
+        def_node_matcher :any_none_block_intersection, <<~PATTERN
+          {
+            (block
+              (call $_receiver ${:any? :none?})
+              (args (arg _key))
+              (send $_argument :member? (lvar _key))
+            )
+            (numblock
+              (call $_receiver ${:any? :none?}) 1
+              (send $_argument :member? (lvar :_1))
+            )
+            (itblock
+              (call $_receiver ${:any? :none?}) :it
+              (send $_argument :member? (lvar :it))
+            )
+          }
+        PATTERN
+
+        MSG = 'Use `%<replacement>s` instead of `%<existing>s`.'
+        STRAIGHT_METHODS = %i[present? any? > positive? !=].freeze
+        NEGATED_METHODS = %i[blank? empty? none? == zero?].freeze
         RESTRICT_ON_SEND = (STRAIGHT_METHODS + NEGATED_METHODS).freeze
 
         def on_send(node)
           return if node.block_literal?
-          return unless (receiver, argument, method_name = bad_intersection?(node))
-
-          dot = node.loc.dot.source
-          message = message(receiver.source, argument.source, method_name, dot, node.source)
+          return unless (dot_node, receiver, argument, method_name = bad_intersection?(node))
 
-          add_offense(node, message: message) do |corrector|
-            bang = straight?(method_name) ? '' : '!'
+          dot = dot_node.loc.dot.source
+          bang = straight?(method_name) ? '' : '!'
+          replacement = "#{bang}#{receiver.source}#{dot}intersect?(#{argument.source})"
 
-            corrector.replace(node, "#{bang}#{receiver.source}#{dot}intersect?(#{argument.source})")
-          end
+          register_offense(node, replacement)
         end
         alias on_csend on_send
 
+        def on_block(node)
+          return unless (receiver, method_name, argument = any_none_block_intersection(node))
+
+          dot = node.send_node.loc.dot.source
+          bang = method_name == :any? ? '' : '!'
+          replacement = "#{bang}#{receiver.source}#{dot}intersect?(#{argument.source})"
+
+          register_offense(node, replacement)
+        end
+        alias on_numblock on_block
+        alias on_itblock on_block
+
         private
 
         def bad_intersection?(node)
-          predicates = if active_support_extensions_enabled?
-                         ACTIVE_SUPPORT_PREDICATES
-                       else
-                         PREDICATES
-                       end
+          bad_intersection_check?(node, bad_intersection_predicates) ||
+            intersection_size_check?(node)
+        end
 
-          bad_intersection_check?(node, predicates)
+        def bad_intersection_predicates
+          if active_support_extensions_enabled?
+            ACTIVE_SUPPORT_PREDICATES
+          else
+            PREDICATES
+          end
         end
 
         def straight?(method_name)
           STRAIGHT_METHODS.include?(method_name.to_sym)
         end
 
-        def message(receiver, argument, method_name, dot, existing)
-          negated = straight?(method_name) ? '' : '!'
-          format(
-            MSG,
-            negated: negated,
-            receiver: receiver,
-            argument: argument,
-            dot: dot,
-            existing: existing
-          )
+        def register_offense(node, replacement)
+          message = format(MSG, replacement: replacement, existing: node.source)
+
+          add_offense(node, message: message) do |corrector|
+            corrector.replace(node, replacement)
+          end
         end
       end
     end

data/lib/rubocop/cop/style/array_intersect_with_single_element.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Style
+      # Use `include?(element)` instead of `intersect?([element])`.
+      #
+      # @safety
+      #   The receiver might not be an array.
+      #
+      # @example
+      #   # bad
+      #   array.intersect?([element])
+      #
+      #   # good
+      #   array.include?(element)
+      class ArrayIntersectWithSingleElement < Base
+        extend AutoCorrector
+
+        MSG = 'Use `include?(element)` instead of `intersect?([element])`.'
+
+        RESTRICT_ON_SEND = %i[intersect?].freeze
+
+        # @!method single_element(node)
+        def_node_matcher :single_element, <<~PATTERN
+          (send _ _ $(array $_))
+        PATTERN
+
+        def on_send(node)
+          array, element = single_element(node)
+          return unless array
+
+          add_offense(
+            node.source_range.with(begin_pos: node.loc.selector.begin_pos)
+          ) do |corrector|
+            corrector.replace(node.loc.selector, 'include?')
+            corrector.replace(
+              array,
+              array.percent_literal? ? element.value.inspect : element.source
+            )
+          end
+        end
+        alias on_csend on_send
+      end
+    end
+  end
+end

data/lib/rubocop/cop/style/bitwise_predicate.rb

@@ -70,18 +70,25 @@ module RuboCop
             (send _ :& _))
         PATTERN
 
+        # rubocop:disable Metrics/AbcSize
         def on_send(node)
           return unless node.receiver&.begin_type?
           return unless (preferred_method = preferred_method(node))
 
           bit_operation = node.receiver.children.first
           lhs, _operator, rhs = *bit_operation
-          preferred = "#{lhs.source}.#{preferred_method}(#{rhs.source})"
+
+          preferred = if preferred_method == 'allbits?' && lhs.source == node.first_argument.source
+                        "#{rhs.source}.allbits?(#{lhs.source})"
+                      else
+                        "#{lhs.source}.#{preferred_method}(#{rhs.source})"
+                      end
 
           add_offense(node, message: format(MSG, preferred: preferred)) do |corrector|
             corrector.replace(node, preferred)
           end
         end
+        # rubocop:enable Metrics/AbcSize
 
         private
 

data/lib/rubocop/cop/style/block_delimiters.rb

@@ -4,7 +4,7 @@
 module RuboCop
   module Cop
     module Style
-      # Check for uses of braces or do/end around single line or
+      # Checks for uses of braces or do/end around single line or
       # multi-line blocks.
       #
       # Methods that can be either procedural or functional and cannot be

data/lib/rubocop/cop/style/case_like_if.rb

@@ -269,7 +269,7 @@ module RuboCop
         end
 
         def regexp_with_named_captures?(node)
-          node.regexp_type? && node.each_capture(named: true).count.positive?
+          node.regexp_type? && node.each_capture(named: true).any?
         end
       end
     end

data/lib/rubocop/cop/style/collection_querying.rb

@@ -0,0 +1,167 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Style
+      # Prefer `Enumerable` predicate methods over expressions with `count`.
+      #
+      # The cop checks calls to `count` without arguments, or with a
+      # block. It doesn't register offenses for `count` with a positional
+      # argument because its behavior differs from predicate methods (`count`
+      # matches the argument using `==`, while `any?`, `none?` and `one?` use
+      # `===`).
+      #
+      # NOTE: This cop doesn't check `length` and `size` methods because they
+      # would yield false positives. For example, `String` implements `length`
+      # and `size`, but it doesn't include `Enumerable`.
+      #
+      # @safety
+      #   The cop is unsafe because receiver might not include `Enumerable`, or
+      #   it has nonstandard implementation of `count` or any replacement
+      #   methods.
+      #
+      #   It's also unsafe because for collections with falsey values, expressions
+      #   with `count` without a block return a different result than methods `any?`,
+      #   `none?` and `one?`:
+      #
+      #   [source,ruby]
+      #   ----
+      #   [nil, false].count.positive?
+      #   [nil].count == 1
+      #   # => true
+      #
+      #   [nil, false].any?
+      #   [nil].one?
+      #   # => false
+      #
+      #   [nil].count == 0
+      #   # => false
+      #
+      #   [nil].none?
+      #   # => true
+      #   ----
+      #
+      #   Autocorrection is unsafe when replacement methods don't iterate over
+      #   every element in collection and the given block runs side effects:
+      #
+      #   [source,ruby]
+      #   ----
+      #   x.count(&:method_with_side_effects).positive?
+      #   # calls `method_with_side_effects` on every element
+      #
+      #   x.any?(&:method_with_side_effects)
+      #   # calls `method_with_side_effects` until first element returns a truthy value
+      #   ----
+      #
+      # @example
+      #
+      #   # bad
+      #   x.count.positive?
+      #   x.count > 0
+      #   x.count != 0
+      #
+      #   x.count(&:foo?).positive?
+      #   x.count { |item| item.foo? }.positive?
+      #
+      #   # good
+      #   x.any?
+      #
+      #   x.any?(&:foo?)
+      #   x.any? { |item| item.foo? }
+      #
+      #   # bad
+      #   x.count.zero?
+      #   x.count == 0
+      #
+      #   # good
+      #   x.none?
+      #
+      #   # bad
+      #   x.count == 1
+      #   x.one?
+      #
+      # @example AllCops:ActiveSupportExtensionsEnabled: false (default)
+      #
+      #   # good
+      #   x.count > 1
+      #
+      # @example AllCops:ActiveSupportExtensionsEnabled: true
+      #
+      #   # bad
+      #   x.count > 1
+      #
+      #   # good
+      #   x.many?
+      #
+      class CollectionQuerying < Base
+        include RangeHelp
+        extend AutoCorrector
+
+        MSG = 'Use `%<prefer>s` instead.'
+
+        RESTRICT_ON_SEND = %i[positive? > != zero? ==].freeze
+
+        REPLACEMENTS = {
+          [:positive?, nil] => :any?,
+          [:>, 0] => :any?,
+          [:!=, 0] => :any?,
+          [:zero?, nil] => :none?,
+          [:==, 0] => :none?,
+          [:==, 1] => :one?,
+          [:>, 1] => :many?
+        }.freeze
+
+        # @!method count_predicate(node)
+        def_node_matcher :count_predicate, <<~PATTERN
+          (send
+            {
+              (any_block $(call !nil? :count) _ _)
+              $(call !nil? :count (block-pass _)?)
+            }
+            {
+              :positive? |
+              :> (int 0) |
+              :!= (int 0) |
+              :zero? |
+              :== (int 0) |
+              :== (int 1) |
+              :> (int 1)
+            })
+        PATTERN
+
+        def on_send(node)
+          return unless (count_node = count_predicate(node))
+
+          replacement_method = replacement_method(node)
+
+          return unless replacement_supported?(replacement_method)
+
+          offense_range = count_node.loc.selector.join(node.source_range.end)
+          add_offense(offense_range,
+                      message: format(MSG, prefer: replacement_method)) do |corrector|
+            corrector.replace(count_node.loc.selector, replacement_method)
+            corrector.remove(removal_range(node))
+          end
+        end
+
+        private
+
+        def replacement_method(node)
+          REPLACEMENTS.fetch([node.method_name, node.first_argument&.value])
+        end
+
+        def replacement_supported?(method_name)
+          return true if active_support_extensions_enabled?
+
+          method_name != :many?
+        end
+
+        def removal_range(node)
+          range = (node.loc.dot || node.loc.selector).join(node.source_range.end)
+
+          range_with_surrounding_space(range, side: :left)
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/style/conditional_assignment.rb

@@ -111,7 +111,7 @@ module RuboCop
         end
       end
 
-      # Check for `if` and `case` statements where each branch is used for
+      # Checks for `if` and `case` statements where each branch is used for
       # both the assignment and comparison of the same variable
       # when using the return of the condition can be used instead.
       #
@@ -444,14 +444,16 @@ module RuboCop
             next if child.parent.dstr_type?
 
             white_space = white_space_range(child, column)
-            corrector.remove(white_space) if white_space.source.strip.empty?
+            corrector.remove(white_space) if white_space
           end
 
           if condition.loc.else && !same_line?(condition.else_branch, condition)
             corrector.remove_preceding(condition.loc.else, condition.loc.else.column - column)
           end
 
-          return unless condition.loc.end && !same_line?(condition.loc.end, condition)
+          return unless condition.loc.end && !same_line?(
+            condition.branches.last.parent.else_branch, condition.loc.end
+          )
 
           corrector.remove_preceding(condition.loc.end, condition.loc.end.column - column)
         end
@@ -463,9 +465,13 @@ module RuboCop
 
         def white_space_range(node, column)
           expression = node.source_range
-          begin_pos = expression.begin_pos - (expression.column - column - 2)
+          end_pos = expression.begin_pos
+          begin_pos = end_pos - (expression.column - column - 2)
 
-          Parser::Source::Range.new(expression.source_buffer, begin_pos, expression.begin_pos)
+          return nil if begin_pos > end_pos
+
+          white_space = Parser::Source::Range.new(expression.source_buffer, begin_pos, end_pos)
+          white_space if white_space.source.strip.empty?
         end
 
         def assignment(node)