Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix false positive/negative in Security/Eval cop #4339

Merged
merged 1 commit into from May 3, 2017

Conversation

pocke
Copy link
Collaborator

@pocke pocke commented May 2, 2017

Changes

  • Add an offense for binding.eval(something)
  • Not add an offense for dstr if it doesn't have a string interpolation
 # bad
binding.eval(something)
eval <<-END
  #{foo}
END

 # good
eval <<-END
  foo
  bar
END

Before submitting the PR make sure the following are checked:

  • Wrote good commit messages.
  • Commit message starts with [Fix #issue-number] (if the related issue exists).
  • Used the same coding conventions as the rest of the project.
  • Feature branch is up-to-date with master (if not - rebase it).
  • Squashed related commits together.
  • Added tests.
  • Added an entry to the Changelog if the new code introduces user-observable changes. See changelog entry format.
  • All tests are passing.
  • The new code doesn't generate RuboCop offenses.
  • The PR relates to only one subject with a clear title
    and description in grammatically correct, complete sentences.
  • Updated cop documentation with rake generate_cops_documentation (required only when you've added a new cop or changed the configuration/documentation of an existing cop).

Changes
=========

- Add an offense for `binding.eval(something)`
- Not add an offense for `dstr` if it doesn't have a string interpolation

```ruby
 # bad
binding.eval(something)
eval <<-END
  #{foo}
END

 # good
eval <<-END
  foo
  bar
END
```
@bbatsov bbatsov merged commit 617cfad into rubocop:master May 3, 2017
@pocke pocke deleted the Security/Eval branch May 4, 2017 03:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants