Class: RuboCop::Cop::Neeto::HtmlInStringLiteral

Inherits:
Base
  • Object
show all
Defined in:
lib/rubocop/cop/neeto/html_in_string_literal.rb

Overview

Ruby strings never escape what is interpolated into them, so HTML built in a string or heredoc outside views is one missed escape away from an injection. Build markup with tag, content_tag, link_to, mail_to, safe_join or a partial, which escape their arguments.

Examples:

HtmlInStringLiteral: true (default)

# bad
"<a href='#{url}'>#{name}</a>"

# bad
<<~HTML
  <p>#{description}</p>
HTML

# good
link_to(name, url)

# good
tag.p(description)

# good (searching for markup is not building it)
body.include?("<table")

Constant Summary collapse

MSG = 
"Do not build HTML in Ruby strings. Use `tag`, `content_tag`, `link_to`, `mail_to`, `safe_join` " \
"or a partial, which escape their arguments."
HTML_TAG = 
%r{<(?:[a-z][a-z0-9]*[\s/>]|/[a-z][a-z0-9]*\s*>)}i
FORMAT_REFERENCE = 
/%<\w+>/
ENCLOSING_LITERAL_TYPES = 
%i[dstr dsym xstr regexp].freeze
SEARCH_METHODS = 
%i[
  include? start_with? end_with? index rindex match match? split scan count delete
  gsub gsub! sub sub! == != eql?
].freeze

Instance Method Summary collapse

Instance Method Details

#on_dstr(node) ⇒ Object 



49
50
51
52
53
 
# File 'lib/rubocop/cop/neeto/html_in_string_literal.rb', line 49

def on_dstr(node)
  return if part_of_another_literal?(node)

  check(node, node.each_child_node(:str).map(&:value).join)
end

#on_str(node) ⇒ Object 



43
44
45
46
47
 
# File 'lib/rubocop/cop/neeto/html_in_string_literal.rb', line 43

def on_str(node)
  return if part_of_another_literal?(node)

  check(node, node.value)
end