Many people in the Ruby community have heard of Rubocop, and likely have some sort of love/hate relationship with it. If you haven't heard of this often polarizing gem, here is the gist of what it does straight from the Rubocop docs.
RuboCop is a Ruby static code analyzer (a.k.a. linter) and code formatter. Out of the box it will enforce many of the guidelines outlined in the community Ruby Style Guide.
However, Rubocop is not just for enforcing style guidelines. Did you know you can use Rubocop to enforce security best practices?!
YEP! That's right! Rubocop has a built in set of Security Cops that can help you write more secure Ruby and Rails code. The cops are:
- Security/Eval- The use of eval represents a serious security risk.
-
Security/JSONLoad - Prefer usage of
JSON.parse
overJSON.load
due to potential security issues. See ruby docs for more information. -
Security/MarshalLoad - Avoid using of
Marshal.load
orMarshal.restore
due to potential security issues. See ruby docs for more information. - Security/Open - The use of Kernel#open represents a serious security risk.
-
Security/YAMLLoad - Prefer usage of
YAML.safe_load
overYAML.load
due to potential security issues. See ruby docs for more information.
In addition to the security cops, there are also a couple of other cops that can improve your code security.
-
Rails/OutputSafety - The use of
html_safe
orraw
may be a security risk. Often using these can lead to a cross site scripting vulnerability. - Style/MutableConstant - Do not assign mutable objects to constants. The security implications of this might be less obvious. For example, if you accidentally update a constant with say user data , and then that constant gets used for another user, suddenly you have a data leak. For this reason, it's best to ensure constants are always immutable.
How to Enable ONLY the Security Cops
If you want to use Rubocop just for the security cops, and not those pesky style cops 😉, here is how you would set it up. First, you need to install the gem.
gem install rubocop
Or if you are using a Gemfile...
gem 'rubocop', require: false
Once the gem is installed you will want to configure it with a rubocop.yml
file in your home directory. To just enable the security focused cops your yaml file should look like this 👇
AllCops:
DisabledByDefault: true
Rails/OutputSafety:
Enabled: true
Security:
Enabled: true
Style/MutableConstant:
Enabled: true
Then all you have to do is run it!
$ rubocop
For more tips on basic usage checkout the rubocop docs.
Happy Coding! 😃