Sha256: 9d1badccd39f94fa71da16c1e26cd9a7b4bf259074f80fb75063a5ba4afe6c35
Contents?: true
Size: 929 Bytes
Versions: 6511
Compression:
Stored size: 929 Bytes
Contents
# frozen_string_literal: true
module RuboCop
module Cop
module Security
# This cop checks for the use of YAML class methods which have
# potential security issues leading to remote code execution when
# loading from an untrusted source.
#
# @example
# # bad
# YAML.load("--- foo")
#
# # good
# YAML.safe_load("--- foo")
# YAML.dump("foo")
#
class YAMLLoad < Cop
MSG = 'Prefer using `YAML.safe_load` over `YAML.load`.'.freeze
def_node_matcher :yaml_load, <<-PATTERN
(send (const {nil? cbase} :YAML) :load ...)
PATTERN
def on_send(node)
yaml_load(node) do
add_offense(node, location: :selector)
end
end
def autocorrect(node)
->(corrector) { corrector.replace(node.loc.selector, 'safe_load') }
end
end
end
end
end
Version data entries
6,511 entries across 6,505 versions & 25 rubygems