Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unmark AutoCorrect: false from Security/JSONLoad #10176

Merged
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
@@ -0,0 +1 @@
* [#10176](https://github.com/rubocop/rubocop/pull/10176): Unmark `AutoCorrect: false` from `Security/JSONLoad`. ([@koic][])
3 changes: 1 addition & 2 deletions config/default.yml
Expand Up @@ -2754,10 +2754,9 @@ Security/JSONLoad:
Reference: 'https://ruby-doc.org/stdlib-2.7.0/libdoc/json/rdoc/JSON.html#method-i-load'
Enabled: true
VersionAdded: '0.43'
VersionChanged: '0.44'
VersionChanged: '<<next>>'
# Autocorrect here will change to a method that may cause crashes depending
# on the value of the argument.
AutoCorrect: false
SafeAutoCorrect: false

Security/MarshalLoad:
Expand Down
2 changes: 1 addition & 1 deletion lib/rubocop/cop/security/json_load.rb
Expand Up @@ -7,7 +7,7 @@ module Security
# security issues.
#
# @safety
# Autocorrect is disabled by default because it's potentially dangerous.
# This cop's autocorrection is unsafe because it's potentially dangerous.
# If using a stream, like `JSON.load(open('file'))`, it will need to call
# `#read` manually, like `JSON.parse(open('file').read)`.
# If reading single values (rather than proper JSON objects), like
Expand Down
3 changes: 2 additions & 1 deletion spec/rubocop/cli/options_spec.rb
Expand Up @@ -1005,7 +1005,8 @@ def on_send(node)

expect(cli.run(['--format', 'emacs', '--display-style-guide', 'example1.rb'])).to eq(1)

output = "#{file}:1:6: C: Security/JSONLoad: Prefer `JSON.parse` over `JSON.load`. (#{url})"
output = "#{file}:1:6: C: [Correctable] Security/JSONLoad: " \
"Prefer `JSON.parse` over `JSON.load`. (#{url})"
expect($stdout.string.lines.to_a[-1]).to eq([output, ''].join("\n"))
end

Expand Down