Sha256: c115f4aed76ca4a6bd37f5f3033f5c438532d2b878180ede30de0e4e06565496
Contents?: true
Size: 1.04 KB
Versions: 197
Compression:
Stored size: 1.04 KB
Contents
# frozen_string_literal: true
module RuboCop
module Cop
module Security
# Checks for the use of Marshal class methods which have
# potential security issues leading to remote code execution when
# loading from an untrusted source.
#
# @example
# # bad
# Marshal.load("{}")
# Marshal.restore("{}")
#
# # good
# Marshal.dump("{}")
#
# # okish - deep copy hack
# Marshal.load(Marshal.dump({}))
#
class MarshalLoad < Base
MSG = 'Avoid using `Marshal.%<method>s`.'
RESTRICT_ON_SEND = %i[load restore].freeze
# @!method marshal_load(node)
def_node_matcher :marshal_load, <<~PATTERN
(send (const {nil? cbase} :Marshal) ${:load :restore}
!(send (const {nil? cbase} :Marshal) :dump ...))
PATTERN
def on_send(node)
marshal_load(node) do |method|
add_offense(node.loc.selector, message: format(MSG, method: method))
end
end
end
end
end
end
Version data entries
197 entries across 190 versions & 19 rubygems