Class: RuboCop::Cop::RosettAi::UnsafeYamlLoad

Inherits:
Base
  • Object
show all
Defined in:
lib/rubocop/cop/rosett_ai/unsafe_yaml_load.rb

Overview

Flags calls to YAML.load which is unsafe for untrusted input.

Use YAML.safe_load, YAML.safe_load_file, or RosettAi::YamlLoader.load_file instead.

Examples:

# bad
YAML.load(string)
YAML.load_file(path)

# good
YAML.safe_load(string)
YAML.safe_load_file(path)
RosettAi::YamlLoader.load_file(path)

Constant Summary collapse

MSG = 
'Use `YAML.safe_load` or `RosettAi::YamlLoader.load_file` instead of `YAML.load`.'

Instance Method Summary collapse

Instance Method Details

#on_send(node) ⇒ Object 



32
33
34
35
36
 
# File 'lib/rubocop/cop/rosett_ai/unsafe_yaml_load.rb', line 32

def on_send(node)
  return unless unsafe_yaml_load?(node)

  add_offense(node)
end

#unsafe_yaml_load?(node) ⇒ Object

YAML.load(...) or YAML.load_file(...)



28
29
30
 
# File 'lib/rubocop/cop/rosett_ai/unsafe_yaml_load.rb', line 28

def_node_matcher :unsafe_yaml_load?, <<~PATTERN
  (send (const {nil? cbase} :YAML) {:load :load_file} ...)
PATTERN