Commits on Sep 28, 2021

1. Add new Security/IoMethods cop …

   ## Summary
   
   Follow up to rubocop#9695 (comment).
   
   This PR adds new `Security/IoMethods` cop.
   
   It checks for the first argument to `IO.read`, `IO.binread`, `IO.write`, `IO.binwrite`,
   `IO.foreach`, and `IO.readlines`.
   
   If argument starts with a pipe character (`'|'`) and the receiver is the `IO` class,
   a subprocess is created in the same way as `Kernel#open`, and its output is returned.
   Consider to use `File.read` to disable the behavior of subprocess invocation.
   
   This cop is unsafe because false positive will occur if the variable passed as
   the first argument is a command that is not a file path.
   
   ```ruby
   # bad
   IO.read(path)
   IO.read('path')
   
   # good
   File.read(path)
   File.read('path')
   IO.read('| command') # Allow intentional command invocation.
   ```
   
   ## Other Information
   
   Below are links related to this cop.
   
   - rubygems/rubygems#4530
   - ruby/ruby#4579

   

   koic committed Sep 28, 2021
   Copy the full SHA

   a88c43c View commit details

   Browse the repository at this point in the history