Class: RuboCop::Cop::GitlabSecurity::SendFileParams

Inherits:
Cop
  • Object
show all
Defined in:
lib/rubocop/cop/gitlab-security/send_file_params.rb

Overview

basename = File.expand_path(“/tmp/myproj”)

filename = File.expand_path(File.join(basename, @file.public_filename))
raise if basename != filename
send_file filename, disposition: 'inline'

Constant Summary collapse

MSG = 
'Do not pass user provided params directly to send_file(), verify
the path with file.expand_path() first. If the path has already been verified
this warning can be disabled using `#rubocop:disable GitlabSecurity/SendFileParams`'.freeze

Instance Method Summary collapse

Instance Method Details

#on_send(node) ⇒ Object 



29
30
31
32
33
34
 
# File 'lib/rubocop/cop/gitlab-security/send_file_params.rb', line 29

def on_send(node)
  return unless node.command?(:send_file)
  return unless node.arguments.any? { |e| params_node?(e) }

  add_offense(node, location: :selector)
end