Class: RuboCop::Cop::DevDoc::Route::ResourcesRequireOnly

Inherits:
Base
  • Object
show all
Defined in:
lib/rubocop/cop/dev_doc/route/resources_require_only.rb

Overview

Always use ‘only:` for `resources` / `resource` in routes.rb.

## Rationale When defining routes in routes.rb, it is important to explicitly specify the desired actions using the ‘only` option. This helps prevent accidentally exposing actions that should not be accessible — leaving the default opens the full RESTful set, which often exposes routes the application has no controller action for, or routes that probably should be locked down.

‘only:` is preferred over `except:` because it is explicit about what is exposed. `except:` exposes everything not in the list, which is easier to misread when the action set changes.

Set ‘RequireOnly: false` to accept both `only:` and `except:`.

✔️
resources :job_applications, only: [:index, :new, :create]

Examples:

EnforcedStyle: RequireOnly (default)

# bad
resources :users
resources :users, except: [:destroy]

# good
resources :users, only: %i[index show]

EnforcedStyle: RequireOnly: false

# bad
resources :users

# good
resources :users, only: %i[index show]
resources :users, except: [:destroy]

Constant Summary collapse

MSG = 
'Specify `only:` or `except:` for `%<method>s :%<name>s` to avoid exposing unintended actions.'.freeze
MSG_REQUIRE_ONLY = 
'Specify `only:` for `%<method>s :%<name>s` ' \
'(`except:` is allowed only with `RequireOnly: false`).'.freeze
RESTRICT_ON_SEND = 
%i[resources resource].freeze

Instance Method Summary collapse

Instance Method Details

#on_send(node) ⇒ Object 



45
46
47
48
49
50
51
52
53
54
55
 
# File 'lib/rubocop/cop/dev_doc/route/resources_require_only.rb', line 45

def on_send(node)
  has_only = key_present?(node, :only)
  has_except = key_present?(node, :except)

  return if has_only
  return if has_except && !require_only?

  name = node.first_argument&.value || '?'
  msg = has_except && require_only? ? MSG_REQUIRE_ONLY : MSG
  add_offense(node.loc.selector, message: format(msg, method: node.method_name, name: name))
end