Sha256: 65ea8ab19651ebe09812436be891976777a489e33838d95decf55a09d12c89ff
Contents?: true
Size: 1.02 KB
Versions: 14
Compression:
Stored size: 1.02 KB
Contents
# frozen_string_literal: true
module RuboCop
module Cop
module Security
# This cop checks for the use of Marshal class methods which have
# potential security issues leading to remote code execution when
# loading from an untrusted source.
#
# @example
# # bad
# Marshal.load("{}")
# Marshal.restore("{}")
#
# # good
# Marshal.dump("{}")
#
# # okish - deep copy hack
# Marshal.load(Marshal.dump({}))
#
class MarshalLoad < Cop
MSG = 'Avoid using `Marshal.%<method>s`.'
def_node_matcher :marshal_load, <<-PATTERN
(send (const {nil? cbase} :Marshal) ${:load :restore}
!(send (const {nil? cbase} :Marshal) :dump ...))
PATTERN
def on_send(node)
marshal_load(node) do |method|
add_offense(node,
location: :selector,
message: format(MSG, method: method))
end
end
end
end
end
end
Version data entries
14 entries across 14 versions & 2 rubygems