Class: RuboCop::Cop::Security::Open

Inherits:
Cop
  • Object
show all
Defined in:
lib/rubocop/cop/security/open.rb

Overview

This cop checks for the use of ‘Kernel#open`. `Kernel#open` enables not only file access but also process invocation by prefixing a pipe symbol (e.g., `open(“| ls”)`). So, it may lead to a serious security risk by using variable input to the argument of `Kernel#open`. It would be better to use `File.open` or `IO.popen` explicitly.

Examples:

# bad
open(something)

# good
File.open(something)
IO.popen(something)

Constant Summary collapse

MSG = 
'The use of `Kernel#open` is a serious security risk.'.freeze

Constants included from Util

Util::ASGN_NODES, Util::CONDITIONAL_NODES, Util::EQUALS_ASGN_NODES, Util::LITERAL_REGEX, Util::LOGICAL_OPERATOR_NODES, Util::MODIFIER_NODES, Util::OPERATOR_METHODS, Util::SHORTHAND_ASGN_NODES

Instance Attribute Summary

Attributes inherited from Cop

#config, #corrections, #offenses, #processed_source

Instance Method Summary collapse

Methods inherited from Cop

#add_offense, all, autocorrect_incompatible_with, badge, #config_to_allow_offenses, #config_to_allow_offenses=, #cop_config, cop_name, #cop_name, #correct, department, #duplicate_location?, #excluded_file?, #find_location, #highlights, inherited, #initialize, #join_force?, lint?, match?, #message, #messages, non_rails, #parse, qualified_cop_name, #relevant_file?, #target_rails_version, #target_ruby_version

Methods included from AST::Sexp

#s

Methods included from NodePattern::Macros

#def_node_matcher, #def_node_search, #node_search, #node_search_all, #node_search_body, #node_search_first

Methods included from AutocorrectLogic

#autocorrect?, #autocorrect_enabled?, #autocorrect_requested?, #support_autocorrect?

Methods included from IgnoredNode

#ignore_node, #ignored_node?, #part_of_ignored_node?

Methods included from Util

begins_its_line?, comment_line?, double_quotes_required?, escape_string, first_part_of_call_chain, interpret_string_escapes, line_range, needs_escaping?, on_node, operator?, parentheses?, same_line?, to_string_literal, to_supported_styles, tokens

Methods included from PathUtil

absolute?, match_path?, pwd, relative_path, reset_pwd, smart_path

Constructor Details

This class inherits a constructor from RuboCop::Cop::Cop

Instance Method Details

#on_send(node) ⇒ Object 



39
40
41
42
43
44
 
# File 'lib/rubocop/cop/security/open.rb', line 39

def on_send(node)
  open?(node) do |code|
    return if safe?(code)
    add_offense(node, location: :selector)
  end
end

#safe?(node) ⇒ Boolean

Returns:

  • (Boolean) 


27
28
29
30
31
32
33
34
35
36
37
 
# File 'lib/rubocop/cop/security/open.rb', line 27

def safe?(node)
  if node.str_type?
    !node.str_content.empty? && !node.str_content.start_with?('|')
  elsif node.dstr_type?
    safe?(node.child_nodes.first)
  elsif node.send_type? && node.method_name == :+
    safe?(node.child_nodes.first)
  else
    false
  end
end