rubocop 1.75.8 → 1.82.1

data/lib/rubocop/cop/naming/method_name.rb

@@ -39,6 +39,26 @@ module RuboCop
       #   # good
       #   def foo_bar; end
       #
+      #   # bad
+      #   define_method :fooBar do
+      #   end
+      #
+      #   # good
+      #   define_method :foo_bar do
+      #   end
+      #
+      #   # bad
+      #   Struct.new(:fooBar)
+      #
+      #   # good
+      #   Struct.new(:foo_bar)
+      #
+      #   # bad
+      #   alias_method :fooBar, :some_method
+      #
+      #   # good
+      #   alias_method :foo_bar, :some_method
+      #
       # @example EnforcedStyle: camelCase
       #   # bad
       #   def foo_bar; end
@@ -46,6 +66,26 @@ module RuboCop
       #   # good
       #   def fooBar; end
       #
+      #   # bad
+      #   define_method :foo_bar do
+      #   end
+      #
+      #   # good
+      #   define_method :fooBar do
+      #   end
+      #
+      #   # bad
+      #   Struct.new(:foo_bar)
+      #
+      #   # good
+      #   Struct.new(:fooBar)
+      #
+      #   # bad
+      #   alias_method :foo_bar, :some_method
+      #
+      #   # good
+      #   alias_method :fooBar, :some_method
+      #
       # @example ForbiddenIdentifiers: ['def', 'super']
       #   # bad
       #   def def; end
@@ -66,13 +106,81 @@ module RuboCop
         MSG = 'Use %<style>s for method names.'
         MSG_FORBIDDEN = '`%<identifier>s` is forbidden, use another method name instead.'
 
+        OPERATOR_METHODS = %i[| ^ & <=> == === =~ > >= < <= << >> + - * /
+                              % ** ~ +@ -@ !@ ~@ [] []= ! != !~ `].to_set.freeze
+
         # @!method sym_name(node)
         def_node_matcher :sym_name, '(sym $_name)'
 
         # @!method str_name(node)
         def_node_matcher :str_name, '(str $_name)'
 
+        # @!method new_struct?(node)
+        def_node_matcher :new_struct?, '(send (const {nil? cbase} :Struct) :new ...)'
+
+        # @!method define_data?(node)
+        def_node_matcher :define_data?, '(send (const {nil? cbase} :Data) :define ...)'
+
         def on_send(node)
+          if node.method?(:define_method) || node.method?(:define_singleton_method)
+            handle_define_method(node)
+          elsif new_struct?(node)
+            handle_new_struct(node)
+          elsif define_data?(node)
+            handle_define_data(node)
+          elsif node.method?(:alias_method)
+            handle_alias_method(node)
+          else
+            handle_attr_accessor(node)
+          end
+        end
+
+        def on_def(node)
+          return if node.operator_method? || matches_allowed_pattern?(node.method_name)
+
+          if forbidden_name?(node.method_name.to_s)
+            register_forbidden_name(node)
+          else
+            check_name(node, node.method_name, node.loc.name)
+          end
+        end
+        alias on_defs on_def
+
+        def on_alias(node)
+          return unless (new_identifier = node.new_identifier).sym_type?
+
+          handle_method_name(new_identifier, new_identifier.value)
+        end
+
+        private
+
+        def handle_define_method(node)
+          return unless node.first_argument&.type?(:str, :sym)
+
+          handle_method_name(node, node.first_argument.value)
+        end
+
+        def handle_new_struct(node)
+          arguments = node.first_argument&.str_type? ? node.arguments[1..] : node.arguments
+          arguments.select { |argument| argument.type?(:sym, :str) }.each do |name|
+            handle_method_name(name, name.value)
+          end
+        end
+
+        def handle_define_data(node)
+          node.arguments.select { |argument| argument.type?(:sym, :str) }.each do |name|
+            handle_method_name(name, name.value)
+          end
+        end
+
+        def handle_alias_method(node)
+          return unless node.arguments.size == 2
+          return unless node.first_argument.type?(:str, :sym)
+
+          handle_method_name(node.first_argument, node.first_argument.value)
+        end
+
+        def handle_attr_accessor(node)
           return unless (attrs = node.attribute_accessor?)
 
           attrs.last.each do |name_item|
@@ -87,45 +195,53 @@ module RuboCop
           end
         end
 
-        def on_def(node)
-          return if node.operator_method? || matches_allowed_pattern?(node.method_name)
+        def handle_method_name(node, name)
+          return if !name || matches_allowed_pattern?(name)
 
-          if forbidden_name?(node.method_name.to_s)
+          if forbidden_name?(name.to_s)
             register_forbidden_name(node)
-          else
-            check_name(node, node.method_name, node.loc.name)
+          elsif !OPERATOR_METHODS.include?(name.to_sym)
+            check_name(node, name, range_position(node))
           end
         end
-        alias on_defs on_def
-
-        private
 
         def forbidden_name?(name)
           forbidden_identifier?(name) || forbidden_pattern?(name)
         end
 
+        # rubocop:disable Metrics/MethodLength, Metrics/AbcSize
         def register_forbidden_name(node)
           if node.any_def_type?
             name_node = node.loc.name
             method_name = node.method_name
-          else
-            attrs = node.attribute_accessor?
+          elsif node.literal?
+            name_node = node
+            method_name = node.value
+          elsif (attrs = node.attribute_accessor?)
             name_node = attrs.last.last
             method_name = attr_name(name_node)
+          else
+            name_node = node.first_argument
+            method_name = node.first_argument.value
           end
           message = format(MSG_FORBIDDEN, identifier: method_name)
           add_offense(name_node, message: message)
         end
+        # rubocop:enable Metrics/MethodLength, Metrics/AbcSize
 
         def attr_name(name_item)
           sym_name(name_item) || str_name(name_item)
         end
 
         def range_position(node)
-          selector_end_pos = node.loc.selector.end_pos + 1
-          expr_end_pos = node.source_range.end_pos
+          if node.loc?(:selector)
+            selector_end_pos = node.loc.selector.end_pos + 1
+            expr_end_pos = node.source_range.end_pos
 
-          range_between(selector_end_pos, expr_end_pos)
+            range_between(selector_end_pos, expr_end_pos)
+          else
+            node.source_range
+          end
         end
 
         def message(style)

data/lib/rubocop/cop/naming/predicate_method.rb

@@ -0,0 +1,319 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Naming
+      # Checks that predicate methods end with `?` and non-predicate methods do not.
+      #
+      # The names of predicate methods (methods that return a boolean value) should end
+      # in a question mark. Methods that don't return a boolean, shouldn't
+      # end in a question mark.
+      #
+      # The cop assesses a predicate method as one that returns boolean values. Likewise,
+      # a method that only returns literal values is assessed as non-predicate. Other predicate
+      # method calls are assumed to return boolean values. The cop does not make an assessment
+      # if the return type is unknown (non-predicate method calls, variables, etc.).
+      #
+      # NOTE: The `initialize` method and operator methods (`def ==`, etc.) are ignored.
+      #
+      # By default, the cop runs in `conservative` mode, which allows a method to be named
+      # with a question mark as long as at least one return value is boolean. In `aggressive`
+      # mode, methods with a question mark will register an offense if any known non-boolean
+      # return values are detected.
+      #
+      # The cop also has `AllowedMethods` configuration in order to prevent the cop from
+      # registering an offense from a method name that does not confirm to the naming
+      # guidelines. By default, `call` is allowed. The cop also has `AllowedPatterns`
+      # configuration to allow method names by regular expression.
+      #
+      # Although returning a call to another predicate method is treated as a boolean value,
+      # certain method names can be known to not return a boolean, despite ending in a `?`
+      # (for example, `Numeric#nonzero?` returns `self` or `nil`). These methods can be
+      # configured using `NonBooleanPredicates`.
+      #
+      # The cop can furthermore be configured to allow all bang methods (method names
+      # ending with `!`), with `AllowBangMethods: true` (default false).
+      #
+      # @example Mode: conservative (default)
+      #   # bad
+      #   def foo
+      #     bar == baz
+      #   end
+      #
+      #   # good
+      #   def foo?
+      #     bar == baz
+      #   end
+      #
+      #   # bad
+      #   def foo?
+      #     5
+      #   end
+      #
+      #   # good
+      #   def foo
+      #     5
+      #   end
+      #
+      #   # bad
+      #   def foo
+      #     x == y
+      #   end
+      #
+      #   # good
+      #   def foo?
+      #     x == y
+      #   end
+      #
+      #   # bad
+      #   def foo
+      #     !x
+      #   end
+      #
+      #   # good
+      #   def foo?
+      #     !x
+      #   end
+      #
+      #   # bad - returns the value of another predicate method
+      #   def foo
+      #     bar?
+      #   end
+      #
+      #   # good
+      #   def foo?
+      #     bar?
+      #   end
+      #
+      #   # good - operator method
+      #   def ==(other)
+      #     hash == other.hash
+      #   end
+      #
+      #   # good - at least one return value is boolean
+      #   def foo?
+      #     return unless bar?
+      #     true
+      #   end
+      #
+      #   # ok - return type is not known
+      #   def foo?
+      #     bar
+      #   end
+      #
+      #   # ok - return type is not known
+      #   def foo
+      #     bar?
+      #   end
+      #
+      # @example Mode: aggressive
+      #   # bad - the method returns nil in some cases
+      #   def foo?
+      #     return unless bar?
+      #     true
+      #   end
+      #
+      # @example AllowedMethods: [call] (default)
+      #   # good
+      #   def call
+      #     foo == bar
+      #   end
+      #
+      # @example AllowedPatterns: [\Afoo]
+      #   # good
+      #   def foo?
+      #     'foo'
+      #   end
+      #
+      # @example AllowBangMethods: false (default)
+      #   # bad
+      #   def save!
+      #     true
+      #   end
+      #
+      # @example AllowBangMethods: true
+      #   # good
+      #   def save!
+      #     true
+      #   end
+      #
+      class PredicateMethod < Base
+        include AllowedMethods
+        include AllowedPattern
+
+        MSG_PREDICATE = 'Predicate method names should end with `?`.'
+        MSG_NON_PREDICATE = 'Non-predicate method names should not end with `?`.'
+
+        def on_def(node)
+          return if allowed?(node)
+
+          return_values = return_values(node.body)
+          return if acceptable?(return_values)
+
+          if node.predicate_method? && potential_non_predicate?(return_values)
+            add_offense(node.loc.name, message: MSG_NON_PREDICATE)
+          elsif !node.predicate_method? && all_return_values_boolean?(return_values)
+            add_offense(node.loc.name, message: MSG_PREDICATE)
+          end
+        end
+        alias on_defs on_def
+
+        private
+
+        def allowed?(node)
+          node.method?(:initialize) ||
+            allowed_method?(node.method_name) ||
+            matches_allowed_pattern?(node.method_name) ||
+            allowed_bang_method?(node) ||
+            node.operator_method? ||
+            node.body.nil?
+        end
+
+        def acceptable?(return_values)
+          # In `conservative` mode, if the method returns `super`, `zsuper`, or a
+          # non-comparison method call, the method name is acceptable.
+          return false unless conservative?
+
+          return_values.any? do |value|
+            value.type?(:super, :zsuper) || unknown_method_call?(value)
+          end
+        end
+
+        def unknown_method_call?(value)
+          return false unless value.call_type?
+
+          !method_returning_boolean?(value)
+        end
+
+        def return_values(node)
+          # Collect all the (implicit and explicit) return values of a node
+          return_values = Set.new(node.begin_type? ? [] : [extract_return_value(node)])
+
+          node.each_descendant(:return) do |return_node|
+            return_values << extract_return_value(return_node)
+          end
+
+          return_values << last_value(node)
+
+          process_return_values(return_values)
+        end
+
+        def all_return_values_boolean?(return_values)
+          values = return_values.reject { |value| value.type?(:super, :zsuper) }
+          return false if values.empty?
+
+          values.all? { |value| boolean_return?(value) }
+        end
+
+        def boolean_return?(value)
+          return true if value.boolean_type?
+
+          method_returning_boolean?(value)
+        end
+
+        def method_returning_boolean?(value)
+          return false unless value.call_type?
+          return false if wayward_predicate?(value.method_name)
+
+          value.comparison_method? || value.predicate_method? || value.negation_method?
+        end
+
+        def potential_non_predicate?(return_values)
+          # Assumes a method to be non-predicate if all return values are non-boolean literals.
+          #
+          # In `Mode: conservative`, if any of the return values is a boolean,
+          # the method name is acceptable.
+          # In `Mode: aggressive`, all return values must be booleans for a predicate
+          # method, or else an offense will be registered.
+          return false if conservative? && return_values.any? { |value| boolean_return?(value) }
+
+          return_values.any? do |value|
+            value.literal? && !value.boolean_type?
+          end
+        end
+
+        def extract_return_value(node)
+          return node unless node.return_type?
+
+          # `return` without a value is a `nil` return.
+          return s(:nil) if node.arguments.empty?
+
+          # When there's a multiple return, it cannot be a predicate
+          # so just return an `array` sexp for simplicity.
+          return s(:array) unless node.arguments.one?
+
+          node.first_argument
+        end
+
+        def last_value(node)
+          value = node.begin_type? ? node.children.last || s(:nil) : node
+
+          value.return_type? ? extract_return_value(value) : value
+        end
+
+        def process_return_values(return_values)
+          return_values.flat_map do |value|
+            if value.conditional?
+              process_return_values(extract_conditional_branches(value))
+            elsif and_or?(value)
+              process_return_values(extract_and_or_clauses(value))
+            else
+              value
+            end
+          end
+        end
+
+        def and_or?(node)
+          node.type?(:and, :or)
+        end
+
+        def extract_and_or_clauses(node)
+          # Recursively traverse an `and` or `or` node to collect all clauses within
+          return node unless and_or?(node)
+
+          [extract_and_or_clauses(node.lhs), extract_and_or_clauses(node.rhs)].flatten
+        end
+
+        def extract_conditional_branches(node)
+          return node unless node.conditional?
+
+          if node.type?(:while, :until)
+            # If there is no body, act as implicit `nil`.
+            node.body ? [last_value(node.body)] : [s(:nil)]
+          else
+            # Branches with no value act as an implicit `nil`.
+            branches = node.branches.map { |branch| branch ? last_value(branch) : s(:nil) }
+            # Missing else branches also act as an implicit `nil`.
+            branches.push(s(:nil)) unless node.else_branch
+            branches
+          end
+        end
+
+        def conservative?
+          cop_config.fetch('Mode', :conservative).to_sym == :conservative
+        end
+
+        def allowed_bang_method?(node)
+          return false unless allow_bang_methods?
+
+          node.bang_method?
+        end
+
+        def allow_bang_methods?
+          cop_config.fetch('AllowBangMethods', false)
+        end
+
+        # If a method ending in `?` is known to not return a boolean value,
+        # (for example, `Numeric#nonzero?`) it should be treated as a non-boolean
+        # value, despite the method naming.
+        def wayward_predicate?(name)
+          wayward_predicates.include?(name.to_s)
+        end
+
+        def wayward_predicates
+          Array(cop_config.fetch('WaywardPredicates', []))
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/naming/{predicate_name.rb → predicate_prefix.rb}

@@ -100,12 +100,12 @@ module RuboCop
       #   # good
       #   def_node_matcher(:even?) { |value| }
       #
-      class PredicateName < Base
+      class PredicatePrefix < Base
         include AllowedMethods
 
         # @!method dynamic_method_define(node)
         def_node_matcher :dynamic_method_define, <<~PATTERN
-          (send nil? #method_definition_macros
+          (send nil? #method_definition_macro?
             (sym $_)
             ...)
         PATTERN
@@ -143,7 +143,7 @@ module RuboCop
             next if predicate_prefixes.include?(forbidden_prefix)
 
             raise ValidationError, <<~MSG.chomp
-              The `Naming/PredicateName` cop is misconfigured. Prefix #{forbidden_prefix} must be included in NamePrefix because it is included in ForbiddenPrefixes.
+              The `Naming/PredicatePrefix` cop is misconfigured. Prefix #{forbidden_prefix} must be included in NamePrefix because it is included in ForbiddenPrefixes.
             MSG
           end
         end
@@ -195,7 +195,7 @@ module RuboCop
           cop_config['UseSorbetSigs']
         end
 
-        def method_definition_macros(macro_name)
+        def method_definition_macro?(macro_name)
           cop_config['MethodDefinitionMacros'].include?(macro_name.to_s)
         end
       end

data/lib/rubocop/cop/security/eval.rb

@@ -11,13 +11,14 @@ module RuboCop
       #
       #   eval(something)
       #   binding.eval(something)
+      #   Kernel.eval(something)
       class Eval < Base
         MSG = 'The use of `eval` is a serious security risk.'
         RESTRICT_ON_SEND = %i[eval].freeze
 
         # @!method eval?(node)
         def_node_matcher :eval?, <<~PATTERN
-          (send {nil? (send nil? :binding)} :eval $!str ...)
+          (send {nil? (send nil? :binding) (const {cbase nil?} :Kernel)} :eval $!str ...)
         PATTERN
 
         def on_send(node)

data/lib/rubocop/cop/security/json_load.rb

@@ -6,22 +6,40 @@ module RuboCop
       # Checks for the use of JSON class methods which have potential
       # security issues.
       #
+      # `JSON.load` and similar methods allow deserialization of arbitrary ruby objects:
+      #
+      # [source,ruby]
+      # ----
+      # require 'json/add/string'
+      # result = JSON.load('{ "json_class": "String", "raw": [72, 101, 108, 108, 111] }')
+      # pp result # => "Hello"
+      # ----
+      #
+      # Never use `JSON.load` for untrusted user input. Prefer `JSON.parse` unless you have
+      # a concrete use-case for `JSON.load`.
+      #
+      # NOTE: Starting with `json` gem version 2.8.0, triggering this behavior without explicitly
+      # passing the `create_additions` keyword argument emits a deprecation warning, with the
+      # goal of being secure by default in the next major version 3.0.0.
+      #
       # @safety
       #   This cop's autocorrection is unsafe because it's potentially dangerous.
-      #   If using a stream, like `JSON.load(open('file'))`, it will need to call
+      #   If using a stream, like `JSON.load(open('file'))`, you will need to call
       #   `#read` manually, like `JSON.parse(open('file').read)`.
-      #   If reading single values (rather than proper JSON objects), like
-      #   `JSON.load('false')`, it will need to pass the `quirks_mode: true`
-      #   option, like `JSON.parse('false', quirks_mode: true)`.
       #   Other similar issues may apply.
       #
       # @example
       #   # bad
-      #   JSON.load("{}")
-      #   JSON.restore("{}")
+      #   JSON.load('{}')
+      #   JSON.restore('{}')
       #
       #   # good
-      #   JSON.parse("{}")
+      #   JSON.parse('{}')
+      #   JSON.unsafe_load('{}')
+      #
+      #   # good - explicit use of `create_additions` option
+      #   JSON.load('{}', create_additions: true)
+      #   JSON.load('{}', create_additions: false)
       #
       class JSONLoad < Base
         extend AutoCorrector
@@ -29,13 +47,17 @@ module RuboCop
         MSG = 'Prefer `JSON.parse` over `JSON.%<method>s`.'
         RESTRICT_ON_SEND = %i[load restore].freeze
 
-        # @!method json_load(node)
-        def_node_matcher :json_load, <<~PATTERN
-          (send (const {nil? cbase} :JSON) ${:load :restore} ...)
+        # @!method insecure_json_load(node)
+        def_node_matcher :insecure_json_load, <<~PATTERN
+          (
+            send (const {nil? cbase} :JSON) ${:load :restore}
+            ...
+            !(hash `(sym $:create_additions))
+          )
         PATTERN
 
         def on_send(node)
-          json_load(node) do |method|
+          insecure_json_load(node) do |method|
             add_offense(node.loc.selector, message: format(MSG, method: method)) do |corrector|
               corrector.replace(node.loc.selector, 'parse')
             end

data/lib/rubocop/cop/security/open.rb

@@ -34,6 +34,7 @@ module RuboCop
       #   # good (literal strings)
       #   open("foo.text")
       #   URI.open("http://example.com")
+      #   URI.parse(url).open
       class Open < Base
         MSG = 'The use of `%<receiver>sopen` is a serious security risk.'
         RESTRICT_ON_SEND = %i[open].freeze

data/lib/rubocop/cop/style/access_modifier_declarations.rb

@@ -348,7 +348,7 @@ module RuboCop
         end
 
         def remove_modifier_node_within_begin(corrector, modifier_node, begin_node)
-          def_node = begin_node.children[1]
+          def_node = begin_node.children[begin_node.children.index(modifier_node) + 1]
           range = modifier_node.source_range.begin.join(def_node.source_range.begin)
           corrector.remove(range)
         end

data/lib/rubocop/cop/style/accessor_grouping.rb

@@ -84,7 +84,10 @@ module RuboCop
 
         def autocorrect(corrector, node)
           if (preferred_accessors = preferred_accessors(node))
-            corrector.replace(node, preferred_accessors)
+            corrector.replace(
+              grouped_style? ? node : range_with_trailing_argument_comment(node),
+              preferred_accessors
+            )
           else
             range = range_with_surrounding_space(node.source_range, side: :left)
             corrector.remove(range)
@@ -196,6 +199,15 @@ module RuboCop
             end
           end.join("\n")
         end
+
+        def range_with_trailing_argument_comment(node)
+          comment = processed_source.ast_with_comments[node.last_argument].last
+          if comment
+            add_range(node.source_range, comment.source_range)
+          else
+            node
+          end
+        end
       end
     end
   end