Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

(PUP-11772) Resolve Security cops main #9159

Merged
merged 2 commits into from
Nov 27, 2023
Merged

(PUP-11772) Resolve Security cops main #9159

merged 2 commits into from
Nov 27, 2023

Commits on Nov 21, 2023

  1. (PUP-11772) Resolve Security/Open 

    When opening a file path, use File.open

When opening a URL, use URI.parse(..).open

The Windows package class includes our Registry module which defines `open`. Use
the fully qualified name to avoid rubocop confusion.
    @joshcooper
    joshcooper committed Nov 21, 2023
    Configuration menu
    Copy the full SHA
    283ba4c View commit details
    Browse the repository at this point in the history

  2. (PUP-11772) Resolve Security/Eval 

    Both actions and functions/data types already define arbitrary code and are
loaded from trusted locations, so using eval isn't any worse.

I updated the ActionBuilder to delegate specific methods to the action. For
example, if an action calls the DSL method `summary "something"`, then the
ActionBuilder will call the corresponding setter on the Action, e.g.
Action#summary = "something".

The Action code is bit more complicated because the arity of the block passed to
`when_invoked=` may be 0, positive or negative, depending on whether it accepts
optional arguments. Since we don't support Ruby 1.8 - 2.6, it could be improved
in the future to not call `eval`, but I didn't feel like bothering.
    @joshcooper
    joshcooper committed Nov 21, 2023
    Configuration menu
    Copy the full SHA
    1e4316b View commit details
    Browse the repository at this point in the history