Sha256: 928c96fc65605d5db43b4d3b0e2e8c19a7bc6c343e4f5412904ec13822d70037
Contents?: true
Size: 1.1 KB
Versions: 5
Compression:
Stored size: 1.1 KB
Contents
# encoding: utf-8
# frozen_string_literal: true
module RuboCop
module Cop
module Rails
# This cop checks for the use of output safety calls like html_safe and
# raw.
#
# @example
# # bad
# "<p>#{text}</p>".html_safe
#
# # good
# content_tag(:p, text)
#
# # bad
# out = ""
# out << content_tag(:li, "one")
# out << content_tag(:li, "two")
# out.html_safe
#
# # good
# out = []
# out << content_tag(:li, "one")
# out << content_tag(:li, "two")
# safe_join(out)
#
class OutputSafety < Cop
MSG = 'Tagging a string as html safe may be a security risk, ' \
'prefer `safe_join` or other Rails tag helpers instead'.freeze
def on_send(node)
receiver, method_name, *_args = *node
if receiver && method_name == :html_safe
add_offense(node, :selector)
elsif receiver.nil? && method_name == :raw
add_offense(node, :selector)
end
end
end
end
end
end
Version data entries
5 entries across 5 versions & 2 rubygems