Contents

# frozen_string_literal: true

module RuboCop
  module Cop
    module Security
      # This cop checks for the use of Marshal class methods which have
      # potential security issues leading to remote code execution when
      # loading from an untrusted source.
      #
      # @example
      #   # bad
      #   Marshal.load("{}")
      #   Marshal.restore("{}")
      #
      #   # good
      #   Marshal.dump("{}")
      #
      #   # okish - deep copy hack
      #   Marshal.load(Marshal.dump({}))
      #
      class MarshalLoad < Cop
        MSG = 'Avoid using `Marshal.%s`.'.freeze

        def_node_matcher :marshal_load, <<-END
          (send (const {nil cbase} :Marshal) ${:load :restore}
          !(send (const {nil cbase} :Marshal) :dump ...))
        END

        def on_send(node)
          marshal_load(node) do |method|
            add_offense(node, :selector, format(MSG, method))
          end
        end
      end
    end
  end
end

Version data entries

4 entries across 4 versions & 1 rubygems

Version	Path
rubocop-0.49.1	lib/rubocop/cop/security/marshal_load.rb
rubocop-0.49.0	lib/rubocop/cop/security/marshal_load.rb
rubocop-0.48.1	lib/rubocop/cop/security/marshal_load.rb
rubocop-0.48.0	lib/rubocop/cop/security/marshal_load.rb