Contents

# frozen_string_literal: true

module RuboCop
  module Cop
    module Security
      # This cop checks for the use of `Kernel#eval` and `Binding#eval`.
      #
      # @example
      #
      #   # bad
      #
      #   eval(something)
      #   binding.eval(something)
      class Eval < Base
        MSG = 'The use of `eval` is a serious security risk.'

        def_node_matcher :eval?, <<~PATTERN
          (send {nil? (send nil? :binding)} :eval $!str ...)
        PATTERN

        def on_send(node)
          eval?(node) do |code|
            return if code.dstr_type? && code.recursive_literal?

            add_offense(node.loc.selector)
          end
        end
      end
    end
  end
end

Version data entries

4 entries across 4 versions & 2 rubygems

Version	Path
grape-extra_validators-2.0.0	vendor/bundle/ruby/2.6.0/gems/rubocop-0.90.0/lib/rubocop/cop/security/eval.rb
rubocop-0.90.0	lib/rubocop/cop/security/eval.rb
rubocop-0.89.1	lib/rubocop/cop/security/eval.rb
rubocop-0.89.0	lib/rubocop/cop/security/eval.rb