123456789_123456789_123456789_123456789_123456789_

Class: RuboCop::Cop::Security::CompoundHash

Relationships & Source Files
Super Chains via Extension / Inclusion / Inheritance
Class Chain:
self, ::RuboCop::Cop::Base, ::RuboCop::ExcludeLimit, NodePattern::Macros, RuboCop::AST::Sexp
Instance Chain:
self, ::RuboCop::Cop::Base, ::RuboCop::Cop::AutocorrectLogic, ::RuboCop::Cop::IgnoredNode, ::RuboCop::Util, RuboCop::AST::Sexp
Inherits: RuboCop::Cop::Base
Defined in: lib/rubocop/cop/security/compound_hash.rb

Overview

Checks for implementations of the hash method which combine values using custom logic instead of delegating to Array#hash.

Manually combining hashes is error prone and hard to follow, especially when there are many values. Poor implementations may also introduce performance or security concerns if they are prone to collisions. Delegating to Array#hash is clearer and safer, although it might be slower depending on the use case.

Examples:

# bad
def hash
  @foo ^ @bar
end

# good
def hash
  [@foo, @bar].hash
end

Cop Safety Information:

  • This cop may be unsafe if the application logic depends on the hash value, however this is inadvisable anyway.

Constant Summary

::RuboCop::Cop::Base - Inherited

EMPTY_OFFENSES, RESTRICT_ON_SEND

Class Attribute Summary

::RuboCop::Cop::Base - Inherited

.gem_requirements, .lint?,
.support_autocorrect?

Returns if class supports autocorrect.
.support_multiple_source?

Override if your cop should be called repeatedly for multiple investigations Between calls to on_new_investigation and on_investigation_end, the result of processed_source will remain constant.

Class Method Summary

::RuboCop::Cop::Base - Inherited

.autocorrect_incompatible_with

List of cops that should not try to autocorrect at the same time as this cop.
.badge

Naming.
.callbacks_needed, .cop_name, .department,
.documentation_url

Returns a url to view this cops documentation online.
.exclude_from_registry

Call for abstract Cop classes.
.inherited,
.joining_forces

Override and return the Force class(es) you need to join.
.match?

Returns true if the cop name or the cop namespace matches any of the given names.
.new,
.requires_gem

Register a version requirement for the given gem name.
.restrict_on_send

::RuboCop::ExcludeLimit - Extended

exclude_limit

Sets up a configuration option to have an exclude limit tracked.
transform

Instance Attribute Summary

::RuboCop::Cop::Base - Inherited

#active_support_extensions_enabled?, #always_autocorrect?, #config, #config_to_allow_offenses, #config_to_allow_offenses=, #contextual_autocorrect?, #processed_source, #string_literals_frozen_by_default?, #target_satisfies_all_gem_version_requirements?

::RuboCop::Cop::AutocorrectLogic - Included

#autocorrect?, #autocorrect_enabled?, #autocorrect_requested?, #autocorrect_with_disable_uncorrectable?, #correctable?, #disable_uncorrectable?, #safe_autocorrect?

Instance Method Summary

::RuboCop::Cop::Base - Inherited

#add_global_offense

Adds an offense that has no particular location.
#add_offense

Adds an offense on the specified range (or node with an expression) Unless that offense is disabled for this range, a corrector will be yielded to provide the cop the opportunity to autocorrect the offense.
#begin_investigation

Called before any investigation.
#callbacks_needed,
#cop_config

Configuration Helpers.
#cop_name, #excluded_file?,
#external_dependency_checksum

This method should be overridden when a cop’s behavior depends on state that lives outside of these locations:
#inspect,
#message

Gets called if no message is specified when calling add_offense or add_global_offense Cops are discouraged to override this; instead pass your message directly.
#name

Alias for Base#cop_name.
#offenses,
#on_investigation_end

Called after all on_…​
#on_new_investigation

Called before all on_…​
#on_other_file

Called instead of all on_…​
#parse

There should be very limited reasons for a Cop to do it’s own parsing.
#parser_engine,
#ready

Called between investigations.
#relevant_file?,
#target_gem_version

Returns a gems locked versions (i.e.
#target_rails_version, #target_ruby_version, #annotate, #apply_correction, #attempt_correction,
#callback_argument

Reserved for Cop::Cop.
#complete_investigation

Called to complete an investigation.
#correct, #current_corrector,
#current_offense_locations

Reserved for Commissioner:
#current_offenses, #currently_disabled_lines, #custom_severity, #default_severity, #disable_uncorrectable, #enabled_line?, #file_name_matches_any?, #find_message, #find_severity, #range_for_original, #range_from_node_or_range,
#reset_investigation

Actually private methods.
#use_corrector

::RuboCop::Cop::AutocorrectLogic - Included

#disable_offense, #disable_offense_at_end_of_line, #disable_offense_before_and_after, #disable_offense_with_eol_or_surround_comment, #heredoc_range, #max_line_length, #multiline_ranges, #multiline_string?,
#range_by_lines

Expand the given range to include all of any lines it covers.
#range_of_first_line, #range_overlaps_offense?, #string_continuation?, #surrounding_heredoc?, #surrounding_percent_array?

::RuboCop::Cop::IgnoredNode - Included

#ignore_node, #ignored_node?, #part_of_ignored_node?, #ignored_nodes

Constructor Details

This class inherits a constructor from RuboCop::Cop::Base

Instance Method Details

#bad_hash_combinator?(node)

[ GitHub ] 

  


# File 'lib/rubocop/cop/security/compound_hash.rb', line 59



def_node_matcher :bad_hash_combinator?, <<~PATTERN
  ({send | op-asgn} _ {:^ | :+ | :* | :|} _)
PATTERN


  








  

    #contained_in_hash_method?(node, &block)  ⇒ Boolean 
  



  

    
  





  


  [ GitHub ]


  

  


# File 'lib/rubocop/cop/security/compound_hash.rb', line 76



def contained_in_hash_method?(node, &block)
  node.each_ancestor.any? do |ancestor|
    hash_method_definition?(ancestor, &block)
  end
end


  








  

    #dynamic_hash_method_definition?(node)  
  

  [ GitHub ]


  

  


# File 'lib/rubocop/cop/security/compound_hash.rb', line 43



def_node_matcher :dynamic_hash_method_definition?, <<~PATTERN
  (block
    (send _ {:define_method | :define_singleton_method}
      (sym :hash))
    (args)
    _)
PATTERN


  








  

    #hash_method_definition?(node)  
  

  [ GitHub ]


  

  


# File 'lib/rubocop/cop/security/compound_hash.rb', line 38



def_node_matcher :hash_method_definition?, <<~PATTERN
  {#static_hash_method_definition? | #dynamic_hash_method_definition?}
PATTERN


  








  

    #monuple_hash?(node)  
  

  [ GitHub ]


  

  


# File 'lib/rubocop/cop/security/compound_hash.rb', line 64



def_node_matcher :monuple_hash?, <<~PATTERN
  (send (array _) :hash)
PATTERN


  








  

    #on_op_asgn(node)  
  



  

    


Alias for #on_send.



  



  [ GitHub ]


  

  


# File 'lib/rubocop/cop/security/compound_hash.rb', line 103



alias on_op_asgn on_send


  








  

    #on_send(node)  
    Also known as: #on_op_asgn
  

  [ GitHub ]


  

  


# File 'lib/rubocop/cop/security/compound_hash.rb', line 88



def on_send(node)
  outer_bad_hash_combinator?(node) do
    contained_in_hash_method?(node) do
      add_offense(node, message: COMBINATOR_IN_HASH_MSG)
    end
  end

  monuple_hash?(node) do
    add_offense(node, message: MONUPLE_HASH_MSG)
  end

  redundant_hash?(node) do
    add_offense(node, message: REDUNDANT_HASH_MSG)
  end
end


  








  

    #outer_bad_hash_combinator?(node)  ⇒ Boolean 
  



  

    
  





  


  [ GitHub ]


  

  


# File 'lib/rubocop/cop/security/compound_hash.rb', line 82



def outer_bad_hash_combinator?(node)
  bad_hash_combinator?(node) do
    yield true if node.each_ancestor.none? { |ancestor| bad_hash_combinator?(ancestor) }
  end
end


  








  

    #redundant_hash?(node)  
  

  [ GitHub ]


  

  


# File 'lib/rubocop/cop/security/compound_hash.rb', line 69



def_node_matcher :redundant_hash?, <<~PATTERN
  (
    ^^(send array ... :hash)
    _ :hash
  )
PATTERN


  








  

    #static_hash_method_definition?(node)  
  

  [ GitHub ]


  

  


# File 'lib/rubocop/cop/security/compound_hash.rb', line 52



def_node_matcher :static_hash_method_definition?, <<~PATTERN
  ({def | defs _} :hash
    (args)
    _)
PATTERN