Sha256: c7f137b0365289958a4d0c3f7e6d3639df955b45a80c4adc38287da8795ce801
Contents?: true
Size: 1.02 KB
Versions: 46
Compression:
Stored size: 1.02 KB
Contents
# frozen_string_literal: true
module RuboCop
module Cop
module Security
# This cop checks for the use of Marshal class methods which have
# potential security issues leading to remote code execution when
# loading from an untrusted source.
#
# @example
# # bad
# Marshal.load("{}")
# Marshal.restore("{}")
#
# # good
# Marshal.dump("{}")
#
# # okish - deep copy hack
# Marshal.load(Marshal.dump({}))
#
class MarshalLoad < Cop
MSG = 'Avoid using `Marshal.%<method>s`.'
def_node_matcher :marshal_load, <<~PATTERN
(send (const {nil? cbase} :Marshal) ${:load :restore}
!(send (const {nil? cbase} :Marshal) :dump ...))
PATTERN
def on_send(node)
marshal_load(node) do |method|
add_offense(node,
location: :selector,
message: format(MSG, method: method))
end
end
end
end
end
end
Version data entries
46 entries across 35 versions & 5 rubygems