Sha256: 9233a396f93223edbcfe5de5a38223d09f4de47afb1a75ddb37352d8297a472e

Contents?: true

Size: 1.05 KB

Versions: 41

Compression:

Stored size: 1.05 KB

Contents

# frozen_string_literal: true

module RuboCop
  module Cop
    module Security
      # This cop checks for the use of Marshal class methods which have
      # potential security issues leading to remote code execution when
      # loading from an untrusted source.
      #
      # @example
      #   # bad
      #   Marshal.load("{}")
      #   Marshal.restore("{}")
      #
      #   # good
      #   Marshal.dump("{}")
      #
      #   # okish - deep copy hack
      #   Marshal.load(Marshal.dump({}))
      #
      class MarshalLoad < Base
        MSG = 'Avoid using `Marshal.%<method>s`.'
        RESTRICT_ON_SEND = %i[load restore].freeze

        # @!method marshal_load(node)
        def_node_matcher :marshal_load, <<~PATTERN
          (send (const {nil? cbase} :Marshal) ${:load :restore}
          !(send (const {nil? cbase} :Marshal) :dump ...))
        PATTERN

        def on_send(node)
          marshal_load(node) do |method|
            add_offense(node.loc.selector, message: format(MSG, method: method))
          end
        end
      end
    end
  end
end

Version data entries

41 entries across 41 versions & 6 rubygems

Version Path
scrapbook-0.3.2 vendor/ruby/2.7.0/gems/rubocop-1.26.0/lib/rubocop/cop/security/marshal_load.rb
scrapbook-0.3.1 vendor/ruby/2.7.0/gems/rubocop-1.26.0/lib/rubocop/cop/security/marshal_load.rb
rubocop-1.29.1 lib/rubocop/cop/security/marshal_load.rb
rubocop-1.29.0 lib/rubocop/cop/security/marshal_load.rb
rubocop-1.28.2 lib/rubocop/cop/security/marshal_load.rb
rubocop-1.28.1 lib/rubocop/cop/security/marshal_load.rb
rubocop-1.28.0 lib/rubocop/cop/security/marshal_load.rb
rubocop-1.27.0 lib/rubocop/cop/security/marshal_load.rb
rubocop-1.26.1 lib/rubocop/cop/security/marshal_load.rb
op_connect-0.1.2 vendor/bundle/ruby/3.1.0/gems/rubocop-1.26.0/lib/rubocop/cop/security/marshal_load.rb
rubocop-1.26.0 lib/rubocop/cop/security/marshal_load.rb
rubocop-1.25.1 lib/rubocop/cop/security/marshal_load.rb
rubocop-1.25.0 lib/rubocop/cop/security/marshal_load.rb
phillipug-foodie-0.1.0 .vendor/ruby/3.0.0/gems/rubocop-1.24.0/lib/rubocop/cop/security/marshal_load.rb
rubocop-1.24.1 lib/rubocop/cop/security/marshal_load.rb
rubocop-1.24.0 lib/rubocop/cop/security/marshal_load.rb
rubocop-1.23.0 lib/rubocop/cop/security/marshal_load.rb
rubocop-1.22.3 lib/rubocop/cop/security/marshal_load.rb
rubocop-1.22.2 lib/rubocop/cop/security/marshal_load.rb
rubocop-1.22.1 lib/rubocop/cop/security/marshal_load.rb