rrubocop 0.8.14

10x faster RuboCop drop-in. Same output format and configs, without maintaining RuboCop gems.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104

//! Security/JSONLoad — prefer JSON.parse over JSON.load/restore.

use tree_sitter::Node;

use crate::cop::shared::{
    argument_nodes, call_method_name, call_receiver, is_const_named, method_node, node_bytes,
    push_replace,
};
use crate::cop::{Cop, CopConfig};
use crate::correction::Correction;
use crate::diagnostic::{Diagnostic, Severity};
use crate::parse::source::SourceFile;

pub struct JsonLoad;

impl Cop for JsonLoad {
    fn name(&self) -> &'static str {
        "Security/JSONLoad"
    }

    fn default_severity(&self) -> Severity {
        Severity::Warning
    }

    fn safe_autocorrect(&self) -> bool {
        false
    }

    fn interested_node_kinds(&self) -> &'static [&'static str] {
        &["call", "command", "command_call"]
    }

    fn check_node(
        &self,
        source: &SourceFile,
        node: Node<'_>,
        _config: &CopConfig,
        diagnostics: &mut Vec<Diagnostic>,
        mut corrections: Option<&mut Vec<Correction>>,
    ) {
        let Some(method) = json_load_method(source, node) else {
            return;
        };
        let method_str = std::str::from_utf8(method).unwrap_or("load");
        let meth_node = method_node(node).unwrap_or(node);
        let (line, column) = source.offset_to_line_col(meth_node.start_byte());
        let mut diag = self.diagnostic(
            source,
            line,
            column,
            format!("Prefer `JSON.parse` over `JSON.{method_str}`."),
        );
        if push_replace(
            &mut corrections,
            meth_node.start_byte(),
            meth_node.end_byte(),
            "parse",
            self.name(),
        ) {
            diag.corrected = true;
        }
        diagnostics.push(diag);
    }
}

fn json_load_method<'a>(source: &'a SourceFile, node: Node<'_>) -> Option<&'a [u8]> {
    let method = call_method_name(source, node)?;
    if method != b"load" && method != b"restore" {
        return None;
    }
    let recv = call_receiver(node)?;
    if !is_const_named(source, recv, b"JSON") || has_create_additions(source, node) {
        return None;
    }
    Some(method)
}

fn has_create_additions(source: &SourceFile, node: Node<'_>) -> bool {
    for arg in argument_nodes(node) {
        if pair_key_is(source, arg, b"create_additions") {
            return true;
        }
        if arg.kind() == "hash" || arg.kind() == "pair" {
            let mut cur = arg.walk();
            for child in arg.named_children(&mut cur) {
                if pair_key_is(source, child, b"create_additions") {
                    return true;
                }
            }
        }
    }
    false
}

fn pair_key_is(source: &SourceFile, node: Node<'_>, key: &[u8]) -> bool {
    if node.kind() != "pair" {
        return false;
    }
    let Some(k) = node.child_by_field_name("key") else {
        return false;
    };
    let bytes = node_bytes(source, k);
    bytes == key || bytes.strip_prefix(b":") == Some(key)
}