Class: RuboCop::Cop::Rails::OutputSafety

Inherits:
Cop
  • Object
show all
Defined in:
lib/rubocop/cop/rails/output_safety.rb

Overview

This cop checks for the use of output safety calls like html_safe, raw, and safe_concat. These methods do not escape content. They simply return a SafeBuffer containing the content as is. Instead, use safe_join to join content and escape it and concat to concatenate content and escape it, ensuring its safety.

Examples:

user_content = "hi"

# bad
"
#{user_content}
".html_safe
=> ActiveSupport::SafeBuffer
"
hi
"

# good
content_tag(:p, user_content)
=> ActiveSupport::SafeBuffer
"
<b>hi</b>
"

# bad
out = ""
out << "
  • #{user_content}
    • "
out << "
  • #{user_content}
    • "
out.html_safe
=> ActiveSupport::SafeBuffer
"
  • hi
  • hi
    • "

# good
out = []
out << content_tag(:li, user_content)
out << content_tag(:li, user_content)
safe_join(out)
=> ActiveSupport::SafeBuffer
"
  • <b>hi</b>
  • <b>hi</b>
    • "

# bad
out = "
    trusted content
    ".html_safe
out.safe_concat(user_content)
=> ActiveSupport::SafeBuffer
"
    trusted_content
    hi"

# good
out = "
    trusted content
    ".html_safe
out.concat(user_content)
=> ActiveSupport::SafeBuffer
"
    trusted_content
    <b>hi</b>"

# safe, though maybe not good style
out = "trusted content"
result = out.concat(user_content)
=> String "trusted contenthi"
# because when rendered in ERB the String will be escaped:
<%= result %>
=> trusted content<b>hi</b>

# bad
(user_content + " " + content_tag(:span, user_content)).html_safe
=> ActiveSupport::SafeBuffer
"hi hi"

# good
safe_join([user_content, " ", content_tag(:span, user_content)])
=> ActiveSupport::SafeBuffer
"<b>hi</b> <b>hi</b>"

    Constant Summary collapse

    MSG = 
    'Tagging a string as html safe may be a security risk.'.freeze

    Constants included from Util

    Util::ASGN_NODES, Util::BYTE_ORDER_MARK, Util::CONDITIONAL_NODES, Util::EQUALS_ASGN_NODES, Util::LITERAL_REGEX, Util::LOGICAL_OPERATOR_NODES, Util::MODIFIER_NODES, Util::OPERATOR_METHODS, Util::SHORTHAND_ASGN_NODES

    Instance Attribute Summary

    Attributes inherited from Cop

    #config, #corrections, #offenses, #processed_source

    Instance Method Summary collapse

    Methods inherited from Cop

    #add_offense, all, autocorrect_incompatible_with, badge, #config_to_allow_offenses, #config_to_allow_offenses=, #cop_config, cop_name, #cop_name, #correct, department, #duplicate_location?, #excluded_file?, #find_location, #highlights, inherited, #initialize, #join_force?, lint?, match?, #message, #messages, non_rails, #parse, qualified_cop_name, #relevant_file?, #target_rails_version, #target_ruby_version

    Methods included from AST::Sexp

    #s

    Methods included from NodePattern::Macros

    #def_node_matcher, #def_node_search, #node_search, #node_search_all, #node_search_body, #node_search_first

    Methods included from AutocorrectLogic

    #autocorrect?, #autocorrect_enabled?, #autocorrect_requested?, #support_autocorrect?

    Methods included from IgnoredNode

    #ignore_node, #ignored_node?, #part_of_ignored_node?

    Methods included from Util

    begins_its_line?, block_length, comment_line?, compatible_external_encoding_for?, directions, double_quotes_required?, effective_column, ends_its_line?, escape_string, first_part_of_call_chain, interpret_string_escapes, line_distance, line_range, move_pos, needs_escaping?, on_node, operator?, parentheses?, parenthesized_call?, preceed?, range_between, range_by_whole_lines, range_with_surrounding_comma, range_with_surrounding_space, same_line?, source_range, strip_quotes, stripped_source_upto, symbol_without_quote?, to_string_literal, to_supported_styles, to_symbol_literal, within_node?

    Methods included from PathUtil

    absolute?, match_path?, relative_path, smart_path

    Constructor Details

    This class inherits a constructor from RuboCop::Cop::Cop

    Instance Method Details

    #on_send(node) ⇒ Object 

    

74
75
76
77
78
79
80
    		 
    # File 'lib/rubocop/cop/rails/output_safety.rb', line 74

def on_send(node)
  return unless looks_like_rails_html_safe?(node) ||
                looks_like_rails_raw?(node) ||
                looks_like_rails_safe_concat?(node)

  add_offense(node, :selector)
end