Class: RuboCop::Cop::Neeto::DirectLiquidRender

Inherits:
Base
  • Object
show all
Defined in:
lib/rubocop/cop/neeto/direct_liquid_render.rb

Overview

Liquid::Template#render does not escape its output, so every variable reaches the page or email as-is. Render Liquid through the shared renderer, which escapes every output and requires an explicit format. Code that only checks a template's syntax uses validate!, which raises Liquid::SyntaxError like Liquid::Template.parse does.

Examples:

DirectLiquidRender: true (default)

# bad
Liquid::Template.parse(template.body).render(variables)

# good
NeetoCommonsBackend::LiquidRenderer.render(template.body, variables, format: :html)

# good
NeetoCommonsBackend::LiquidRenderer.render(template.subject, variables, format: :text)

# bad
Liquid::Template.parse(metadata["body"])

# good
NeetoCommonsBackend::LiquidRenderer.validate!(metadata["body"])

Constant Summary collapse

MSG = 
"Do not use `Liquid::Template.%<method>s` directly. Render with " \
"`NeetoCommonsBackend::LiquidRenderer.render(template, variables, format: :html)`, which escapes " \
"every output, or check syntax with `NeetoCommonsBackend::LiquidRenderer.validate!(template)`."
RESTRICT_ON_SEND = 
%i[parse new].freeze

Instance Method Summary collapse

Instance Method Details

#on_send(node) ⇒ Object 



39
40
41
42
43
 
# File 'lib/rubocop/cop/neeto/direct_liquid_render.rb', line 39

def on_send(node)
  return unless liquid_template_build?(node)

  add_offense(node, message: format(MSG, method: node.method_name))
end