Class: RuboCop::Cop::Security::JSONLoad

Inherits:
Base
  • Object
show all
Extended by:
AutoCorrector
Defined in:
lib/rubocop/cop/security/json_load.rb

Overview

Checks for the use of JSON class methods which have potential security issues.

‘JSON.load` and similar methods allow deserialization of arbitrary ruby objects:

source,ruby

require ‘json/add/string’ result = JSON.load(‘{ “json_class”: “String”, “raw”: [72, 101, 108, 108, 111] }’) pp result # => “Hello”

Never use ‘JSON.load` for untrusted user input. Prefer `JSON.parse` unless you have a concrete use-case for `JSON.load`.

NOTE: Starting with ‘json` gem version 2.8.0, triggering this behavior without explicitly passing the `create_additions` keyword argument emits a deprecation warning, with the goal of being secure by default in the next major version 3.0.0.

Examples:

# bad
JSON.load('{}')
JSON.restore('{}')

# good
JSON.parse('{}')
JSON.unsafe_load('{}')

# good - explicit use of `create_additions` option
JSON.load('{}', create_additions: true)
JSON.load('{}', create_additions: false)

Constant Summary collapse

MSG = 
'Prefer `JSON.parse` over `JSON.%<method>s`.'
RESTRICT_ON_SEND = 
i[load restore].freeze

Instance Attribute Summary

Attributes inherited from Base

#config, #processed_source

Instance Method Summary collapse

Methods included from AutoCorrector

support_autocorrect?

Methods inherited from Base

#active_support_extensions_enabled?, #add_global_offense, #add_offense, #always_autocorrect?, autocorrect_incompatible_with, badge, #begin_investigation, #callbacks_needed, callbacks_needed, #config_to_allow_offenses, #config_to_allow_offenses=, #contextual_autocorrect?, #cop_config, #cop_name, cop_name, department, documentation_url, exclude_from_registry, #excluded_file?, #external_dependency_checksum, inherited, #initialize, #inspect, joining_forces, lint?, match?, #message, #offenses, #on_investigation_end, #on_new_investigation, #on_other_file, #parse, #parser_engine, #ready, #relevant_file?, requires_gem, #string_literals_frozen_by_default?, support_autocorrect?, support_multiple_source?, #target_gem_version, #target_rails_version, #target_ruby_version

Methods included from ExcludeLimit

#exclude_limit

Methods included from AutocorrectLogic

#autocorrect?, #autocorrect_enabled?, #autocorrect_requested?, #autocorrect_with_disable_uncorrectable?, #correctable?, #disable_uncorrectable?, #safe_autocorrect?

Methods included from IgnoredNode

#ignore_node, #ignored_node?, #part_of_ignored_node?

Methods included from Util

silence_warnings

Constructor Details

This class inherits a constructor from RuboCop::Cop::Base

Instance Method Details

#insecure_json_load(node) ⇒ Object 



51
52
53
54
55
56
57
 
# File 'lib/rubocop/cop/security/json_load.rb', line 51

def_node_matcher :insecure_json_load, "(\n  send (const {nil? cbase} :JSON) ${:load :restore}\n  ...\n  !(hash `(sym $:create_additions))\n)\n"

#on_send(node) ⇒ Object 



59
60
61
62
63
64
65
 
# File 'lib/rubocop/cop/security/json_load.rb', line 59

def on_send(node)
  insecure_json_load(node) do |method|
    add_offense(node.loc.selector, message: format(MSG, method: method)) do |corrector|
      corrector.replace(node.loc.selector, 'parse')
    end
  end
end