Sha256: 789b00f199bdc51c8a05357dcbc1f159379d8909f8069f4541fcad1227ae891c
Contents?: true
Size: 1.01 KB
Versions: 30
Compression:
Stored size: 1.01 KB
Contents
# frozen_string_literal: true
module RuboCop
module Cop
module Security
# This cop checks for the use of Marshal class methods which have
# potential security issues leading to remote code execution when
# loading from an untrusted source.
#
# @example
# # bad
# Marshal.load("{}")
# Marshal.restore("{}")
#
# # good
# Marshal.dump("{}")
#
# # okish - deep copy hack
# Marshal.load(Marshal.dump({}))
#
class MarshalLoad < Base
MSG = 'Avoid using `Marshal.%<method>s`.'
RESTRICT_ON_SEND = %i[load restore].freeze
def_node_matcher :marshal_load, <<~PATTERN
(send (const {nil? cbase} :Marshal) ${:load :restore}
!(send (const {nil? cbase} :Marshal) :dump ...))
PATTERN
def on_send(node)
marshal_load(node) do |method|
add_offense(node.loc.selector, message: format(MSG, method: method))
end
end
end
end
end
end
Version data entries
30 entries across 30 versions & 2 rubygems