From 186b2143abacf60611896bad829ad7eb3456f77d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jarka=20Ko=C5=A1anov=C3=A1?= <jarka@gitlab.com>
Date: Thu, 15 Nov 2018 10:50:04 +0100
Subject: Add cop prohibiting params argument in url_for

---
 rubocop/cop/safe_params.rb | 34 ++++++++++++++++++++++++++++++++++
 rubocop/rubocop.rb         |  1 +
 2 files changed, 35 insertions(+)
 create mode 100644 rubocop/cop/safe_params.rb

(limited to 'rubocop')

diff --git a/rubocop/cop/safe_params.rb b/rubocop/cop/safe_params.rb
new file mode 100644
index 00000000000..250c16232e4
--- /dev/null
+++ b/rubocop/cop/safe_params.rb
@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    class SafeParams < RuboCop::Cop::Cop
+      MSG = 'Use `safe_params` instead of `params` in url_for.'.freeze
+
+      METHOD_NAME_PATTERN = :url_for
+      UNSAFE_PARAM = :params
+
+      def on_send(node)
+        return unless method_name(node) == METHOD_NAME_PATTERN
+
+        add_offense(node, location: :expression) unless safe_params?(node)
+      end
+
+      private
+
+      def safe_params?(node)
+        node.descendants.each do |param_node|
+          next unless param_node.descendants.empty?
+
+          return false if method_name(param_node) == UNSAFE_PARAM
+        end
+
+        true
+      end
+
+      def method_name(node)
+        node.children[1]
+      end
+    end
+  end
+end
diff --git a/rubocop/rubocop.rb b/rubocop/rubocop.rb
index 6c9b8753c1a..4489159f422 100644
--- a/rubocop/rubocop.rb
+++ b/rubocop/rubocop.rb
@@ -5,6 +5,7 @@ require_relative 'cop/gitlab/httparty'
 require_relative 'cop/gitlab/finder_with_find_by'
 require_relative 'cop/gitlab/union'
 require_relative 'cop/include_sidekiq_worker'
+require_relative 'cop/safe_params'
 require_relative 'cop/avoid_return_from_blocks'
 require_relative 'cop/avoid_break_from_strong_memoize'
 require_relative 'cop/avoid_route_redirect_leading_slash'
-- 
cgit v1.2.3