Class: RuboCop::Cop::Betterment::UnscopedFind

Inherits:
RuboCop::Cop
  • Object
show all
Defined in:
lib/rubocop/cop/betterment/unscoped_find.rb

Constant Summary collapse

MSG = 
"Records are being retrieved directly using user input.\nPlease query for the associated record in a way that enforces authorization (e.g. \"trust-root chaining\").\n\nINSTEAD OF THIS:\nPost.find(params[:post_id])\n\nDO THIS:\ncurrent_user.posts.find(params[:post_id])\n\nSee here for more information on this error:\nhttps://github.com/Betterment/rubocop-betterment/blob/master/README.md#bettermentunscopedfind\n".freeze
METHOD_PATTERN = 
/^find_by_(.+?)(!)?$/.freeze
FINDS = 
i(find find_by find_by! where).freeze

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(config = nil, options = nil) ⇒ UnscopedFind

Returns a new instance of UnscopedFind.



31
32
33
34
35
 
# File 'lib/rubocop/cop/betterment/unscoped_find.rb', line 31

def initialize(config = nil, options = nil)
  super(config, options)
  config = @config.for_cop(self)
  @unauthenticated_models = config.fetch("unauthenticated_models", []).map(&:to_sym)
end

Instance Attribute Details

#unauthenticated_models ⇒ Object

Returns the value of attribute unauthenticated_models.



5
6
7
 
# File 'lib/rubocop/cop/betterment/unscoped_find.rb', line 5

def unauthenticated_models
  @unauthenticated_models
end

Instance Method Details

#on_send(node) ⇒ Object 



37
38
39
40
41
42
43
44
45
46
47
 
# File 'lib/rubocop/cop/betterment/unscoped_find.rb', line 37

def on_send(node)
  _, _, *arg_nodes = *node
  return unless
    (
        find?(node) ||
        custom_scope_find?(node) ||
        static_method_name(node.method_name)
    ) && !@unauthenticated_models.include?(Utils::Parser.get_root_token(node))

  add_offense(node) if find_param_arg(arg_nodes)
end