rubocop 1.80.2 → 1.86.1

data/lib/rubocop/cop/mixin/hash_transform_method.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative 'hash_transform_method/autocorrection'
+
 module RuboCop
   module Cop
     # Common functionality for Style/HashTransformKeys and
@@ -27,68 +29,16 @@ module RuboCop
         end
       end
 
-      # Internal helper class to hold autocorrect data
-      Autocorrection = Struct.new(:match, :block_node, :leading, :trailing) do
-        def self.from_each_with_object(node, match)
-          new(match, node, 0, 0)
-        end
-
-        def self.from_hash_brackets_map(node, match)
-          new(match, node.children.last, 'Hash['.length, ']'.length)
-        end
-
-        def self.from_map_to_h(node, match)
-          if node.parent&.block_type? && node.parent.send_node == node
-            strip_trailing_chars = 0
-          else
-            map_range = node.children.first.source_range
-            node_range = node.source_range
-            strip_trailing_chars = node_range.end_pos - map_range.end_pos
-          end
-
-          new(match, node.children.first, 0, strip_trailing_chars)
-        end
-
-        def self.from_to_h(node, match)
-          new(match, node, 0, 0)
-        end
-
-        def strip_prefix_and_suffix(node, corrector)
-          expression = node.source_range
-          corrector.remove_leading(expression, leading)
-          corrector.remove_trailing(expression, trailing)
-        end
-
-        def set_new_method_name(new_method_name, corrector)
-          range = block_node.send_node.loc.selector
-          if (send_end = block_node.send_node.loc.end)
-            # If there are arguments (only true in the `each_with_object`
-            # case)
-            range = range.begin.join(send_end)
-          end
-          corrector.replace(range, new_method_name)
-        end
-
-        def set_new_arg_name(transformed_argname, corrector)
-          corrector.replace(block_node.arguments, "|#{transformed_argname}|")
-        end
-
-        def set_new_body_expression(transforming_body_expr, corrector)
-          body_source = transforming_body_expr.source
-          if transforming_body_expr.hash_type? && !transforming_body_expr.braces?
-            body_source = "{ #{body_source} }"
-          end
-
-          corrector.replace(block_node.body, body_source)
-        end
-      end
-
-      # @!method array_receiver?(node)
-      def_node_matcher :array_receiver?, <<~PATTERN
-        {(array ...) (send _ :each_with_index) (send _ :with_index _ ?) (send _ :zip ...)}
+      # @!method hash_receiver?(node)
+      def_node_matcher :hash_receiver?, <<~PATTERN
+        {(hash ...)
+         (send _ {:to_h :to_hash :merge :merge! :update :invert :except :tally} ...)
+         (block (send _ {:group_by :to_h :tally :transform_keys :transform_keys!
+                         :transform_values :transform_values!}) ...)
+         (block (send _ :each_with_object (hash)) ...)}
       PATTERN
 
-      def on_block(node) # rubocop:disable InternalAffairs/NumblockHandler
+      def on_block(node) # rubocop:disable InternalAffairs/NumblockHandler, InternalAffairs/ItblockHandler
         on_bad_each_with_object(node) do |*match|
           handle_possible_offense(node, match, 'each_with_object')
         end

data/lib/rubocop/cop/mixin/line_length_help.rb

@@ -8,8 +8,27 @@ module RuboCop
 
       private
 
-      def ignore_cop_directives?
-        config.for_cop('Layout/LineLength')['IgnoreCopDirectives']
+      def allow_rbs_inline_annotation?
+        config.for_cop('Layout/LineLength')['AllowRBSInlineAnnotation']
+      end
+
+      def rbs_inline_annotation_on_source_line?(line_index)
+        source_line_number = line_index + processed_source.buffer.first_line
+        comment = processed_source.comment_at_line(source_line_number)
+
+        return false unless comment
+
+        comment.text.start_with?(/#:|#\[.+\]|#\|/)
+      end
+
+      def allow_cop_directives?
+        # TODO: This logic for backward compatibility with deprecated `IgnoreCopDirectives` option.
+        # The following three lines will be removed in RuboCop 2.0.
+        ignore_cop_directives = config.for_cop('Layout/LineLength')['IgnoreCopDirectives']
+        return true if ignore_cop_directives
+        return false if ignore_cop_directives == false
+
+        config.for_cop('Layout/LineLength')['AllowCopDirectives']
       end
 
       def directive_on_source_line?(line_index)

data/lib/rubocop/cop/mixin/method_complexity.rb

@@ -73,7 +73,7 @@ module RuboCop
 
       def location(node)
         if LSP.enabled?
-          end_range = node.loc.respond_to?(:name) ? node.loc.name : node.loc.begin
+          end_range = node.loc?(:name) ? node.loc.name : node.loc.begin
           node.source_range.begin.join(end_range)
         else
           node.source_range

data/lib/rubocop/cop/mixin/multiline_expression_indentation.rb

@@ -200,7 +200,7 @@ module RuboCop
       end
 
       def grouped_expression?(node)
-        node.begin_type? && node.loc.respond_to?(:begin) && node.loc.begin
+        node.begin_type? && node.loc?(:begin) && node.loc.begin
       end
 
       def inside_arg_list_parentheses?(node, ancestor)

data/lib/rubocop/cop/mixin/multiline_literal_brace_layout.rb

@@ -127,7 +127,7 @@ module RuboCop
         parent ||= node
 
         if node.respond_to?(:loc) &&
-           node.loc.respond_to?(:heredoc_end) &&
+           node.loc?(:heredoc_end) &&
            node.loc.heredoc_end.last_line >= parent.last_line
           return true
         end

data/lib/rubocop/cop/mixin/space_after_punctuation.rb

@@ -8,8 +8,8 @@ module RuboCop
       MSG = 'Space missing after %<token>s.'
 
       def on_new_investigation
-        each_missing_space(processed_source.tokens) do |token|
-          add_offense(token.pos, message: format(MSG, token: kind(token))) do |corrector|
+        each_missing_space(processed_source.tokens) do |token, kind|
+          add_offense(token.pos, message: format(MSG, token: kind)) do |corrector|
             PunctuationCorrector.add_space(corrector, token)
           end
         end
@@ -19,11 +19,12 @@ module RuboCop
 
       def each_missing_space(tokens)
         tokens.each_cons(2) do |token1, token2|
-          next unless kind(token1)
+          kind = kind(token1, token2)
+          next unless kind
           next unless space_missing?(token1, token2)
           next unless space_required_before?(token2)
 
-          yield token1
+          yield token1, kind
         end
       end
 

data/lib/rubocop/cop/mixin/statement_modifier.rb

@@ -100,12 +100,6 @@ module RuboCop
         node.parent.send_type?
       end
 
-      def max_line_length
-        return unless config.cop_enabled?('Layout/LineLength')
-
-        config.for_cop('Layout/LineLength')['Max']
-      end
-
       def comment_disables_cop?(comment)
         regexp_pattern = "# rubocop : (disable|todo) ([^,],)* (all|#{cop_name})"
         Regexp.new(regexp_pattern.gsub(' ', '\s*')).match?(comment)

data/lib/rubocop/cop/mixin/trailing_comma.rb

@@ -95,13 +95,16 @@ module RuboCop
         node.multiline? && !allowed_multiline_argument?(node)
       end
 
+      # rubocop:disable Metrics/AbcSize
       def method_name_and_arguments_on_same_line?(node)
-        return false unless node.call_type?
+        return false if !node.call_type? || node.last_line != node.last_argument.last_line
+        return true if node.last_argument.hash_type? && node.last_argument.braces?
 
-        line = node.loc.selector.nil? ? node.loc.line : node.loc.selector.line
+        line = node.loc.selector&.line || node.loc.line
 
-        line == node.last_argument.last_line && node.last_line == node.last_argument.last_line
+        line == node.last_argument.last_line
       end
+      # rubocop:enable Metrics/AbcSize
 
       # A single argument with the closing bracket on the same line as the end
       # of the argument is not considered multiline, even if the argument
@@ -140,7 +143,7 @@ module RuboCop
       end
 
       def last_item_precedes_newline?(node)
-        after_last_item = node.children.last.source_range.end.join(node.loc.end.begin)
+        after_last_item = node.children.last.source_range.end.join(node.source_range.end)
 
         after_last_item.source.start_with?(/,?\s*(#.*)?\n/)
       end
@@ -185,7 +188,7 @@ module RuboCop
 
       def heredoc?(node)
         return false unless node.is_a?(RuboCop::AST::Node)
-        return true if node.loc.respond_to?(:heredoc_body)
+        return true if node.loc?(:heredoc_body)
 
         return heredoc_send?(node) if node.send_type?
 

data/lib/rubocop/cop/naming/block_parameter_name.rb

@@ -38,7 +38,7 @@ module RuboCop
       class BlockParameterName < Base
         include UncommunicativeName
 
-        def on_block(node) # rubocop:disable InternalAffairs/NumblockHandler
+        def on_block(node) # rubocop:disable InternalAffairs/NumblockHandler, InternalAffairs/ItblockHandler
           return unless node.arguments?
 
           check(node, node.arguments)

data/lib/rubocop/cop/naming/method_name.rb

@@ -147,7 +147,9 @@ module RuboCop
         alias on_defs on_def
 
         def on_alias(node)
-          handle_method_name(node.new_identifier, node.new_identifier.value)
+          return unless (new_identifier = node.new_identifier).sym_type?
+
+          handle_method_name(new_identifier, new_identifier.value)
         end
 
         private
@@ -232,7 +234,7 @@ module RuboCop
         end
 
         def range_position(node)
-          if node.loc.respond_to?(:selector)
+          if node.loc?(:selector)
             selector_end_pos = node.loc.selector.end_pos + 1
             expr_end_pos = node.source_range.end_pos
 

data/lib/rubocop/cop/naming/predicate_method.rb

@@ -113,6 +113,18 @@ module RuboCop
       #     true
       #   end
       #
+      # @example AllowedMethods: [call] (default)
+      #   # good
+      #   def call
+      #     foo == bar
+      #   end
+      #
+      # @example AllowedPatterns: [\Afoo]
+      #   # good
+      #   def foo?
+      #     'foo'
+      #   end
+      #
       # @example AllowBangMethods: false (default)
       #   # bad
       #   def save!
@@ -125,6 +137,17 @@ module RuboCop
       #     true
       #   end
       #
+      # @example WaywardPredicates: ['infinite?', 'nonzero?'] (default)
+      #   # good
+      #   def non_predicate_method(num)
+      #     num.infinite?
+      #   end
+      #
+      #   # good
+      #   def non_predicate_method(num)
+      #     num.nonzero?
+      #   end
+      #
       class PredicateMethod < Base
         include AllowedMethods
         include AllowedPattern
@@ -181,8 +204,7 @@ module RuboCop
             return_values << extract_return_value(return_node)
           end
 
-          last_value = last_value(node)
-          return_values << last_value if last_value
+          return_values << last_value(node)
 
           process_return_values(return_values)
         end
@@ -235,8 +257,9 @@ module RuboCop
         end
 
         def last_value(node)
-          value = node.begin_type? ? node.children.last : node
-          value&.return_type? ? extract_return_value(value) : value
+          value = node.begin_type? ? node.children.last || s(:nil) : node
+
+          value.return_type? ? extract_return_value(value) : value
         end
 
         def process_return_values(return_values)

data/lib/rubocop/cop/naming/predicate_prefix.rb

@@ -63,17 +63,17 @@ module RuboCop
       #   end
       #
       # @example UseSorbetSigs: false (default)
-      #  # bad
-      #  sig { returns(String) }
-      #  def is_this_thing_on
-      #    "yes"
-      #  end
-      #
-      #  # good - Sorbet signature is not evaluated
-      #  sig { returns(String) }
-      #  def is_this_thing_on?
-      #    "yes"
-      #  end
+      #   # bad
+      #   sig { returns(String) }
+      #   def is_this_thing_on
+      #     "yes"
+      #   end
+      #
+      #   # good - Sorbet signature is not evaluated
+      #   sig { returns(String) }
+      #   def is_this_thing_on?
+      #     "yes"
+      #   end
       #
       # @example UseSorbetSigs: true
       #   # bad

data/lib/rubocop/cop/offense.rb

@@ -66,6 +66,13 @@ module RuboCop
         alias_method :last_line, :line
         alias_method :last_column, :column
 
+        attr_reader :source_buffer
+
+        def initialize(line, column, source_line, begin_pos, end_pos)
+          super
+          @source_buffer = Parser::Source::Buffer.new('(pseudo)', source: source_line)
+        end
+
         def column_range
           column...last_column
         end
@@ -139,7 +146,8 @@ module RuboCop
       # @return [Parser::Source::Range]
       #   the range of the code that is highlighted
       def highlighted_area
-        Parser::Source::Range.new(source_line, column, column + column_length)
+        source_buffer = Parser::Source::Buffer.new(location.source_buffer.name, source: source_line)
+        Parser::Source::Range.new(source_buffer, column, column + column_length)
       end
 
       # @api private

data/lib/rubocop/cop/registry.rb

@@ -16,7 +16,7 @@ module RuboCop
     end
 
     # Registry that tracks all cops by their badge and department.
-    class Registry
+    class Registry # rubocop:disable Metrics/ClassLength
       include Enumerable
 
       def self.all
@@ -46,7 +46,7 @@ module RuboCop
         global.qualify_badge(badge).first == badge
       end
 
-      attr_reader :options
+      attr_reader :options, :warnings
 
       def initialize(cops = [], options = {})
         @registry = {}
@@ -58,6 +58,7 @@ module RuboCop
 
         @enabled_cache = {}.compare_by_identity
         @disabled_cache = {}.compare_by_identity
+        @warnings = {}
       end
 
       def enlist(cop)
@@ -132,7 +133,7 @@ module RuboCop
       # @return [String] Qualified cop name
       def qualified_cop_name(name, path, warn: true)
         badge = Badge.parse(name)
-        print_warning(name, path) if warn && department_missing?(badge, name)
+        print_department_missing_warning(name, path) if warn && department_missing?(badge, name)
         return name if registered?(badge)
 
         potential_badges = qualify_badge(badge)
@@ -148,12 +149,12 @@ module RuboCop
         !badge.qualified? && unqualified_cop_names.include?(name)
       end
 
-      def print_warning(name, path)
-        message = "#{path}: Warning: no department given for #{name}."
+      def print_department_missing_warning(name, path)
+        message = "no department given for #{name}."
         if path.end_with?('.rb')
           message += ' Run `rubocop -a --only Migration/DepartmentName` to fix.'
         end
-        warn message
+        emit_warning(path, message)
       end
 
       def unqualified_cop_names
@@ -274,6 +275,10 @@ module RuboCop
         attr_reader :global
       end
 
+      def warnings?(path)
+        @warnings[path]
+      end
+
       private
 
       def initialize_copy(reg)
@@ -297,18 +302,20 @@ module RuboCop
       end
 
       def resolve_badge(given_badge, real_badge, source_path, warn: true)
-        unless given_badge.match?(real_badge)
-          path = PathUtil.smart_path(source_path)
-
-          if warn
-            warn("#{path}: #{given_badge} has the wrong namespace - " \
-                 "replace it with #{given_badge.with_department(real_badge.department)}")
-          end
+        if warn && !given_badge.match?(real_badge)
+          emit_warning(source_path,
+                       "#{given_badge} has the wrong namespace - " \
+                       "replace it with #{given_badge.with_department(real_badge.department)}")
         end
 
         real_badge.to_s
       end
 
+      def emit_warning(path, message)
+        Registry.global.warnings[path] = true
+        warn "#{PathUtil.smart_path(path)}: Warning: #{message}"
+      end
+
       def registered?(badge)
         clear_enrollment_queue
         @registry.key?(badge)

data/lib/rubocop/cop/security/eval.rb

@@ -3,15 +3,28 @@
 module RuboCop
   module Cop
     module Security
-      # Checks for the use of `Kernel#eval` and `Binding#eval`.
+      # Checks for the use of `Kernel#eval` and `Binding#eval` with
+      # dynamic strings as arguments. Evaluating non-literal strings
+      # can enable code injection attacks and makes it difficult to
+      # reason about what code will actually be executed.
+      #
+      # Calls to `eval` with literal strings are not flagged by this cop,
+      # as they do not pose the same injection risk.
       #
       # @example
       #
       #   # bad
-      #
       #   eval(something)
       #   binding.eval(something)
       #   Kernel.eval(something)
+      #
+      #   # good - use safer alternatives
+      #   obj.public_send(method_name)
+      #   obj.send(method_name, *args)
+      #
+      #   # good - literal strings are allowed
+      #   eval("1 + 1")
+      #   binding.eval("foo")
       class Eval < Base
         MSG = 'The use of `eval` is a serious security risk.'
         RESTRICT_ON_SEND = %i[eval].freeze

data/lib/rubocop/cop/security/json_load.rb

@@ -6,22 +6,40 @@ module RuboCop
       # Checks for the use of JSON class methods which have potential
       # security issues.
       #
+      # `JSON.load` and similar methods allow deserialization of arbitrary ruby objects:
+      #
+      # [source,ruby]
+      # ----
+      # require 'json/add/string'
+      # result = JSON.load('{ "json_class": "String", "raw": [72, 101, 108, 108, 111] }')
+      # pp result # => "Hello"
+      # ----
+      #
+      # Never use `JSON.load` for untrusted user input. Prefer `JSON.parse` unless you have
+      # a concrete use-case for `JSON.load`.
+      #
+      # NOTE: Starting with `json` gem version 2.8.0, triggering this behavior without explicitly
+      # passing the `create_additions` keyword argument emits a deprecation warning, with the
+      # goal of being secure by default in the next major version 3.0.0.
+      #
       # @safety
       #   This cop's autocorrection is unsafe because it's potentially dangerous.
-      #   If using a stream, like `JSON.load(open('file'))`, it will need to call
+      #   If using a stream, like `JSON.load(open('file'))`, you will need to call
       #   `#read` manually, like `JSON.parse(open('file').read)`.
-      #   If reading single values (rather than proper JSON objects), like
-      #   `JSON.load('false')`, it will need to pass the `quirks_mode: true`
-      #   option, like `JSON.parse('false', quirks_mode: true)`.
       #   Other similar issues may apply.
       #
       # @example
       #   # bad
-      #   JSON.load("{}")
-      #   JSON.restore("{}")
+      #   JSON.load('{}')
+      #   JSON.restore('{}')
       #
       #   # good
-      #   JSON.parse("{}")
+      #   JSON.parse('{}')
+      #   JSON.unsafe_load('{}')
+      #
+      #   # good - explicit use of `create_additions` option
+      #   JSON.load('{}', create_additions: true)
+      #   JSON.load('{}', create_additions: false)
       #
       class JSONLoad < Base
         extend AutoCorrector
@@ -29,13 +47,17 @@ module RuboCop
         MSG = 'Prefer `JSON.parse` over `JSON.%<method>s`.'
         RESTRICT_ON_SEND = %i[load restore].freeze
 
-        # @!method json_load(node)
-        def_node_matcher :json_load, <<~PATTERN
-          (send (const {nil? cbase} :JSON) ${:load :restore} ...)
+        # @!method insecure_json_load(node)
+        def_node_matcher :insecure_json_load, <<~PATTERN
+          (
+            send (const {nil? cbase} :JSON) ${:load :restore}
+            ...
+            !`(pair (sym :create_additions) _)
+          )
         PATTERN
 
         def on_send(node)
-          json_load(node) do |method|
+          insecure_json_load(node) do |method|
             add_offense(node.loc.selector, message: format(MSG, method: method)) do |corrector|
               corrector.replace(node.loc.selector, 'parse')
             end

data/lib/rubocop/cop/style/access_modifier_declarations.rb

@@ -326,8 +326,7 @@ module RuboCop
           argument_less_modifier_node = find_argument_less_modifier_node(node)
           if argument_less_modifier_node
             corrector.insert_after(argument_less_modifier_node, "\n\n#{source}")
-          elsif (ancestor = node.each_ancestor(:class, :module).first)
-
+          elsif (ancestor = node.each_ancestor(:class, :module, :sclass).first)
             corrector.insert_before(ancestor.loc.end, "#{node.method_name}\n\n#{source}\n")
           else
             corrector.replace(node, "#{node.method_name}\n\n#{source}")
@@ -349,8 +348,20 @@ module RuboCop
 
         def remove_modifier_node_within_begin(corrector, modifier_node, begin_node)
           def_node = begin_node.children[begin_node.children.index(modifier_node) + 1]
-          range = modifier_node.source_range.begin.join(def_node.source_range.begin)
-          corrector.remove(range)
+          # Stop the removal range at the first comment that precedes the def, if
+          # any exist. Without this, comments between the modifier and the def are
+          # dropped because they fall inside the removed range.
+          end_pos = first_comment_or_node_start(def_node)
+          corrector.remove(modifier_node.source_range.begin.join(end_pos))
+        end
+
+        def first_comment_or_node_start(node)
+          preceding = processed_source.ast_with_comments[node].select do |comment|
+            comment.loc.line < node.loc.line
+          end
+          return node.source_range.begin if preceding.empty?
+
+          preceding.first.source_range.begin
         end
 
         def def_source(node, def_nodes)

data/lib/rubocop/cop/style/accessor_grouping.rb

@@ -4,8 +4,10 @@ module RuboCop
   module Cop
     module Style
       # Checks for grouping of accessors in `class` and `module` bodies.
-      # By default it enforces accessors to be placed in grouped declarations,
-      # but it can be configured to enforce separating them in multiple declarations.
+      # By default it enforces accessors to be placed in grouped
+      # declarations, reducing boilerplate. It can also be configured
+      # to enforce separating them into individual declarations for
+      # easier diffing and per-attribute documentation.
       #
       # NOTE: If there is a method call before the accessor method it is always allowed
       # as it might be intended like Sorbet.

data/lib/rubocop/cop/style/alias.rb

@@ -4,7 +4,10 @@ module RuboCop
   module Cop
     module Style
       # Enforces the use of either `#alias` or `#alias_method`
-      # depending on configuration.
+      # depending on configuration. Consistent use of one or the
+      # other prevents confusion about their different semantics
+      # (e.g., `alias` is resolved at parse time, while `alias_method`
+      # is resolved at runtime).
       # It also flags uses of `alias :symbol` rather than `alias bareword`.
       #
       # However, it will always enforce `method_alias` when used `alias`

data/lib/rubocop/cop/style/and_or.rb

@@ -128,6 +128,7 @@ module RuboCop
 
         def correct_other(node, corrector)
           return if node.parenthesized_call?
+          return if node.children.empty? && node.equal?(node.parent.children.last)
 
           corrector.wrap(node, '(', ')')
         end