Class: RuboCop::Cop::Security::JSONLoad
- Extended by:
- AutoCorrector
- Defined in:
- lib/rubocop/cop/security/json_load.rb
Overview
This cop checks for the use of JSON class methods which have potential security issues.
Autocorrect is disabled by default because it's potentially dangerous. If using a stream, like `JSON.load(open('file'))`, it will need to call `#read` manually, like `JSON.parse(open('file').read)`. If reading single values (rather than proper JSON objects), like `JSON.load('false')`, it will need to pass the `quirks_mode: true` option, like `JSON.parse('false', quirks_mode: true)`. Other similar issues may apply.
Constant Summary collapse
- MSG =
'Prefer `JSON.parse` over `JSON.%<method>s`.'
- RESTRICT_ON_SEND =
%i[load restore].freeze
Instance Attribute Summary
Attributes inherited from Base
Instance Method Summary collapse
Methods included from AutoCorrector
Methods inherited from Base
#add_global_offense, #add_offense, autocorrect_incompatible_with, badge, #callbacks_needed, callbacks_needed, #config_to_allow_offenses, #config_to_allow_offenses=, #cop_config, #cop_name, cop_name, department, documentation_url, exclude_from_registry, #excluded_file?, #external_dependency_checksum, inherited, #initialize, joining_forces, lint?, match?, #message, #offenses, #on_investigation_end, #on_new_investigation, #on_other_file, #ready, #relevant_file?, support_autocorrect?, support_multiple_source?, #target_rails_version, #target_ruby_version
Methods included from ExcludeLimit
Methods included from AutocorrectLogic
#autocorrect?, #autocorrect_enabled?, #autocorrect_requested?, #correctable?, #disable_uncorrectable?, #safe_autocorrect?
Methods included from IgnoredNode
#ignore_node, #ignored_node?, #part_of_ignored_node?
Methods included from Util
Constructor Details
This class inherits a constructor from RuboCop::Cop::Base
Instance Method Details
#json_load(node) ⇒ Object
32 33 34 |
# File 'lib/rubocop/cop/security/json_load.rb', line 32 def_node_matcher :json_load, <<~PATTERN (send (const {nil? cbase} :JSON) ${:load :restore} ...) PATTERN |
#on_send(node) ⇒ Object
36 37 38 39 40 41 42 |
# File 'lib/rubocop/cop/security/json_load.rb', line 36 def on_send(node) json_load(node) do |method| add_offense(node.loc.selector, message: format(MSG, method: method)) do |corrector| corrector.replace(node.loc.selector, 'parse') end end end |