.simplycop_security.yml in simplycop-1.14.6 vs .simplycop_security.yml in simplycop-1.14.7
- old
+ new
@@ -1,10 +1,12 @@
require:
- './lib/simplycop/security/csrf_token_validation.rb'
- './lib/simplycop/security/reject_all_requests_local.rb'
- './lib/simplycop/security/check_for_vulnerable_code.rb'
+# Custom security cops
+
Security/CSRFTokenValidation:
Enabled: true
Details: >-
It is important to have authenticity token validation enabled.
if you need to disable it please check with InfoSec department first.
@@ -18,5 +20,33 @@
Security/CheckForVulnerableCode:
Enabled: true
Details: >-
Please make sure that this is addressed accordingly.
Do not hesitate to contact infosec for help and guidance
+
+# Standard security cops
+
+# Overridden to false in Chopin
+Security/CompoundHash:
+ Enabled: true
+
+Security/Eval:
+ Enabled: true
+ Exclude:
+ - 'spec/**/*.rb'
+
+# Overridden to false on Chopin
+Security/IoMethods:
+ Enabled: true
+
+# Needs override in chopin spec
+Security/JSONLoad:
+ Enabled: true
+
+Security/MarshalLoad:
+ Enabled: true
+
+Security/Open:
+ Enabled: true
+
+Security/YAMLLoad:
+ Enabled: true