Skip to content

Commit

Permalink
Unmark AutoCorrect: false from Security/JSONLoad
Browse files Browse the repository at this point in the history
This `AutoCorrect: false` looks like it was set when there was no way
to safe autocorrect by `SafeAutocorrect: false`.
#3584

Test code for `Security/JSONLoad`'s autocorrection exists. So it can be
enabled by default. However, it is still unsafe because `SafeAutocorrect: false`.
  • Loading branch information
koic committed Oct 8, 2021
1 parent f7a3088 commit 8c9692b
Show file tree
Hide file tree
Showing 4 changed files with 5 additions and 4 deletions.
@@ -0,0 +1 @@
* [#10176](https://github.com/rubocop/rubocop/pull/10176): Unmark `AutoCorrect: false` from `Security/JSONLoad`. ([@koic][])
3 changes: 1 addition & 2 deletions config/default.yml
Expand Up @@ -2754,10 +2754,9 @@ Security/JSONLoad:
Reference: 'https://ruby-doc.org/stdlib-2.7.0/libdoc/json/rdoc/JSON.html#method-i-load'
Enabled: true
VersionAdded: '0.43'
VersionChanged: '0.44'
VersionChanged: '<<next>>'
# Autocorrect here will change to a method that may cause crashes depending
# on the value of the argument.
AutoCorrect: false
SafeAutoCorrect: false

Security/MarshalLoad:
Expand Down
2 changes: 1 addition & 1 deletion lib/rubocop/cop/security/json_load.rb
Expand Up @@ -7,7 +7,7 @@ module Security
# security issues.
#
# @safety
# Autocorrect is disabled by default because it's potentially dangerous.
# This cop's autocorrection is unsafe because it's potentially dangerous.
# If using a stream, like `JSON.load(open('file'))`, it will need to call
# `#read` manually, like `JSON.parse(open('file').read)`.
# If reading single values (rather than proper JSON objects), like
Expand Down
3 changes: 2 additions & 1 deletion spec/rubocop/cli/options_spec.rb
Expand Up @@ -1005,7 +1005,8 @@ def on_send(node)

expect(cli.run(['--format', 'emacs', '--display-style-guide', 'example1.rb'])).to eq(1)

output = "#{file}:1:6: C: Security/JSONLoad: Prefer `JSON.parse` over `JSON.load`. (#{url})"
output = "#{file}:1:6: C: [Correctable] Security/JSONLoad: " \
"Prefer `JSON.parse` over `JSON.load`. (#{url})"
expect($stdout.string.lines.to_a[-1]).to eq([output, ''].join("\n"))
end

Expand Down

0 comments on commit 8c9692b

Please sign in to comment.