Class: RuboCop::Cop::Security::JSONLoad

Inherits:
Base
  • Object
show all
Extended by:
AutoCorrector
Defined in:
lib/rubocop/cop/security/json_load.rb

Overview

This cop checks for the use of JSON class methods which have potential security issues.

Autocorrect is disabled by default because it’s potentially dangerous. If using a stream, like ‘JSON.load(open(’file’))‘, it will need to call `#read` manually, like `JSON.parse(open(’file’).read)‘. If reading single values (rather than proper JSON objects), like `JSON.load(’false’)‘, it will need to pass the `quirks_mode: true` option, like `JSON.parse(’false’, quirks_mode: true)‘. Other similar issues may apply.

Examples:

# bad
JSON.load("{}")
JSON.restore("{}")

# good
JSON.parse("{}")

Constant Summary collapse

MSG = 
'Prefer `JSON.parse` over `JSON.%<method>s`.'
RESTRICT_ON_SEND = 
%i[load restore].freeze

Constants included from Util

Util::LITERAL_REGEX

Instance Attribute Summary

Attributes inherited from Base

#config, #processed_source

Instance Method Summary collapse

Methods included from AutoCorrector

support_autocorrect?

Methods inherited from Base

#add_global_offense, #add_offense, autocorrect_incompatible_with, badge, #callbacks_needed, callbacks_needed, #config_to_allow_offenses, #config_to_allow_offenses=, #cop_config, #cop_name, cop_name, department, documentation_url, exclude_from_registry, #excluded_file?, #external_dependency_checksum, inherited, #initialize, joining_forces, lint?, match?, #message, #offenses, #on_investigation_end, #on_new_investigation, #on_other_file, #ready, #relevant_file?, support_autocorrect?, support_multiple_source?, #target_rails_version, #target_ruby_version

Methods included from AutocorrectLogic

#autocorrect?, #autocorrect_enabled?, #autocorrect_requested?, #correctable?, #disable_uncorrectable?, #safe_autocorrect?

Methods included from IgnoredNode

#ignore_node, #ignored_node?, #part_of_ignored_node?

Methods included from Util

add_parentheses, args_begin, args_end, begins_its_line?, comment_line?, comment_lines?, double_quotes_required?, escape_string, first_part_of_call_chain, indent, interpret_string_escapes, line_range, needs_escaping?, on_node, parentheses?, same_line?, to_string_literal, to_supported_styles, trim_string_interporation_escape_character

Methods included from PathUtil

absolute?, hidden_dir?, hidden_file?, hidden_file_in_not_hidden_dir?, match_path?, maybe_hidden_file?, relative_path, smart_path

Constructor Details

This class inherits a constructor from RuboCop::Cop::Base

Instance Method Details

#on_send(node) ⇒ Object 



35
36
37
38
39
40
41
 
# File 'lib/rubocop/cop/security/json_load.rb', line 35

def on_send(node)
  json_load(node) do |method|
    add_offense(node.loc.selector, message: format(MSG, method: method)) do |corrector|
      corrector.replace(node.loc.selector, 'parse')
    end
  end
end