Parameters should be whitelisted for mass assignment Open
params.require(:assignment_form).permit!- Read upRead up
- Exclude checks
Mass assignment is a feature of Rails which allows an application to create a record from the values of a hash.
Example:
User.new(params[:user])Unfortunately, if there is a user field called admin which controls administrator access, now any user can make themselves an administrator.
attr_accessible and attr_protected can be used to limit mass assignment. However, Brakeman will warn unless attr_accessible is used, or mass assignment is completely disabled.
There are two different mass assignment warnings which can arise. The first is when mass assignment actually occurs, such as the example above. This results in a warning like
Unprotected mass assignment near line 61: User.new(params[:user])The other warning is raised whenever a model is found which does not use attr_accessible. This produces generic warnings like
Mass assignment is not restricted using attr_accessiblewith a list of affected models.
In Rails 3.1 and newer, mass assignment can easily be disabled:
config.active_record.whitelist_attributes = trueUnfortunately, it can also easily be bypassed:
User.new(params[:user], :without_protection => true)Brakeman will warn on uses of without_protection.
Class has too many lines. [391/100] Open
class AssignmentsController < ApplicationController
include AssignmentHelper
include AuthorizationHelper
autocomplete :user, :name
before_action :authorize- Read upRead up
- Exclude checks
This cop checks if the length a class exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
Assignment Branch Condition size for create is too high. [80.72/15] Open
def create
@assignment_form = AssignmentForm.new(assignment_form_params)
if params[:button]
# E2138 issue #3
find_existing_assignment = Assignment.find_by(name: @assignment_form.assignment.name, course_id: @assignment_form.assignment.course_id)- Read upRead up
- Exclude checks
This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric
Class AssignmentsController has 48 methods (exceeds 20 allowed). Consider refactoring. Open
class AssignmentsController < ApplicationController
include AssignmentHelper
include AuthorizationHelper
autocomplete :user, :name
before_action :authorizeFile assignments_controller.rb has 393 lines of code (exceeds 250 allowed). Consider refactoring. Open
class AssignmentsController < ApplicationController
include AssignmentHelper
include AuthorizationHelper
autocomplete :user, :name
before_action :authorizeMethod has too many lines. [42/10] Open
def create
@assignment_form = AssignmentForm.new(assignment_form_params)
if params[:button]
# E2138 issue #3
find_existing_assignment = Assignment.find_by(name: @assignment_form.assignment.name, course_id: @assignment_form.assignment.course_id)- Read upRead up
- Exclude checks
This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
Assignment Branch Condition size for delete is too high. [40.64/15] Open
def delete
begin
assignment_form = AssignmentForm.create_form_object(params[:id])
user = session[:user]
# Issue 1017 - allow instructor to delete assignment created by TA.- Read upRead up
- Exclude checks
This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric
Assignment Branch Condition size for edit_params_setting is too high. [36.11/15] Open
def edit_params_setting
@assignment = Assignment.find(params[:id])
@num_submissions_round = @assignment.find_due_dates('submission').nil? ? 0 : @assignment.find_due_dates('submission').count
@num_reviews_round = @assignment.find_due_dates('review').nil? ? 0 : @assignment.find_due_dates('review').count
- Read upRead up
- Exclude checks
This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric
Assignment Branch Condition size for key_nonexistent_handler is too high. [34.25/15] Open
def key_nonexistent_handler
@assignment = Assignment.find(params[:id])
@assignment.course_id = params[:course_id]
if @assignment.save- Read upRead up
- Exclude checks
This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric
Assignment Branch Condition size for unassigned_rubrics_warning is too high. [29.22/15] Open
def unassigned_rubrics_warning
if !list_unassigned_rubrics.empty? && request.original_fullpath == "/assignments/#{@assignment_form.assignment.id}/edit"
rubrics_needed = needed_rubrics(list_unassigned_rubrics)
ExpertizaLogger.error LoggerMessage.new(controller_name, session[:user].name, "Rubrics missing for #{@assignment_form.assignment.name}.", request)
if flash.now[:error] != 'Failed to save the assignment: ["Total weight of rubrics should add up to either 0 or 100%"]'- Read upRead up
- Exclude checks
This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric
Method has too many lines. [20/10] Open
def edit_params_setting
@assignment = Assignment.find(params[:id])
@num_submissions_round = @assignment.find_due_dates('submission').nil? ? 0 : @assignment.find_due_dates('submission').count
@num_reviews_round = @assignment.find_due_dates('review').nil? ? 0 : @assignment.find_due_dates('review').count
- Read upRead up
- Exclude checks
This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
Assignment Branch Condition size for retrieve_assignment_form is too high. [22.23/15] Open
def retrieve_assignment_form
@assignment_form = AssignmentForm.create_form_object(params[:id])
@assignment_form.assignment.instructor ||= current_user
params[:assignment_form][:assignment_questionnaire].reject! do |q|
q[:questionnaire_id].empty?- Read upRead up
- Exclude checks
This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric
Assignment Branch Condition size for update_feedback_attributes is too high. [21.59/15] Open
def update_feedback_attributes
if params[:set_pressed][:bool] == 'false'
flash[:error] = "There has been some submissions for the rounds of reviews that you're trying to reduce. You can only increase the round of review."
elsif @assignment_form.update_attributes(assignment_form_params, current_user)
flash[:note] = 'The assignment was successfully saved....'- Read upRead up
- Exclude checks
This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric
Method has too many lines. [15/10] Open
def delete
begin
assignment_form = AssignmentForm.create_form_object(params[:id])
user = session[:user]
# Issue 1017 - allow instructor to delete assignment created by TA.- Read upRead up
- Exclude checks
This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
Assignment Branch Condition size for assignment_form_save_handler is too high. [20.22/15] Open
def assignment_form_save_handler
exist_assignment = Assignment.find_by(name: @assignment_form.assignment.name)
assignment_form_params[:assignment][:id] = exist_assignment.id.to_s
fix_assignment_missing_path
update_assignment_form(exist_assignment)- Read upRead up
- Exclude checks
This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric
Method has too many lines. [14/10] Open
def edit
user_timezone_specified
edit_params_setting
assignment_staggered_deadline?
update_due_date- Read upRead up
- Exclude checks
This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
Method has too many lines. [14/10] Open
def update
unless params.key?(:assignment_form)
key_nonexistent_handler
return
end- Read upRead up
- Exclude checks
This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
Method has too many lines. [13/10] Open
def copy
update_copy_session
# check new assignment submission directory and old assignment submission directory
new_assign_id = AssignmentForm.copy(params[:id], @user)
if new_assign_id- Read upRead up
- Exclude checks
This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
Assignment Branch Condition size for edit is too high. [18.03/15] Open
def edit
user_timezone_specified
edit_params_setting
assignment_staggered_deadline?
update_due_date- Read upRead up
- Exclude checks
This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric
Perceived complexity for create is too high. [10/7] Open
def create
@assignment_form = AssignmentForm.new(assignment_form_params)
if params[:button]
# E2138 issue #3
find_existing_assignment = Assignment.find_by(name: @assignment_form.assignment.name, course_id: @assignment_form.assignment.course_id)- Read upRead up
- Exclude checks
This cop tries to produce a complexity score that's a measure of the
complexity the reader experiences when looking at a method. For that
reason it considers when nodes as something that doesn't add as much
complexity as an if or a &&. Except if it's one of those special
case/when constructs where there's no expression after case. Then
the cop treats it as an if/elsif/elsif... and lets all the when
nodes count. In contrast to the CyclomaticComplexity cop, this cop
considers else nodes as adding complexity.
Example:
def my_method # 1
if cond # 1
case var # 2 (0.8 + 4 * 0.2, rounded)
when 1 then func_one
when 2 then func_two
when 3 then func_three
when 4..10 then func_other
end
else # 1
do_something until a && b # 2
end # ===
end # 7 complexity pointsMethod create has a Cognitive Complexity of 15 (exceeds 5 allowed). Consider refactoring. Open
def create
@assignment_form = AssignmentForm.new(assignment_form_params)
if params[:button]
# E2138 issue #3
find_existing_assignment = Assignment.find_by(name: @assignment_form.assignment.name, course_id: @assignment_form.assignment.course_id)- Read upRead up
Cognitive Complexity
Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.
A method's cognitive complexity is based on a few simple rules:
- Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
- Code is considered more complex for each "break in the linear flow of the code"
- Code is considered more complex when "flow breaking structures are nested"
Further reading
Assignment Branch Condition size for assignment_staggered_deadline? is too high. [17.75/15] Open
def assignment_staggered_deadline?
if @assignment_form.assignment.staggered_deadline == true
@review_rounds = @assignment_form.assignment.num_review_rounds
@due_date_all ||= AssignmentDueDate.where(parent_id: @assignment_form.assignment.id)
@assignment_submission_due_dates = @due_date_all.select { |due_date| due_date.deadline_type_id == DeadlineHelper::DEADLINE_TYPE_SUBMISSION }- Read upRead up
- Exclude checks
This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric
Assignment Branch Condition size for update_assignment_form is too high. [17.46/15] Open
def update_assignment_form(exist_assignment)
questionnaire_array = assignment_form_params[:assignment_questionnaire]
questionnaire_array.each { |cur_questionnaire| cur_questionnaire[:assignment_id] = exist_assignment.id.to_s }
assignment_form_params[:assignment_questionnaire]
due_array = assignment_form_params[:due_date]- Read upRead up
- Exclude checks
This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric
Cyclomatic complexity for create is too high. [8/6] Open
def create
@assignment_form = AssignmentForm.new(assignment_form_params)
if params[:button]
# E2138 issue #3
find_existing_assignment = Assignment.find_by(name: @assignment_form.assignment.name, course_id: @assignment_form.assignment.course_id)- Read upRead up
- Exclude checks
This cop checks that the cyclomatic complexity of methods is not higher than the configured maximum. The cyclomatic complexity is the number of linearly independent paths through a method. The algorithm counts decision points and adds one.
An if statement (or unless or ?:) increases the complexity by one. An else branch does not, since it doesn't add a decision point. The && operator (or keyword and) can be converted to a nested if statement, and ||/or is shorthand for a sequence of ifs, so they also add one. Loops can be said to have an exit condition, so they add one.
Method has too many lines. [11/10] Open
def key_nonexistent_handler
@assignment = Assignment.find(params[:id])
@assignment.course_id = params[:course_id]
if @assignment.save- Read upRead up
- Exclude checks
This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
Assignment Branch Condition size for update is too high. [16.12/15] Open
def update
unless params.key?(:assignment_form)
key_nonexistent_handler
return
end- Read upRead up
- Exclude checks
This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric
Method has too many lines. [11/10] Open
def update_feedback_attributes
if params[:set_pressed][:bool] == 'false'
flash[:error] = "There has been some submissions for the rounds of reviews that you're trying to reduce. You can only increase the round of review."
elsif @assignment_form.update_attributes(assignment_form_params, current_user)
flash[:note] = 'The assignment was successfully saved....'- Read upRead up
- Exclude checks
This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
Method create has 42 lines of code (exceeds 25 allowed). Consider refactoring. Open
def create
@assignment_form = AssignmentForm.new(assignment_form_params)
if params[:button]
# E2138 issue #3
find_existing_assignment = Assignment.find_by(name: @assignment_form.assignment.name, course_id: @assignment_form.assignment.course_id)Assignment Branch Condition size for user_timezone_specified is too high. [15.17/15] Open
def user_timezone_specified
ExpertizaLogger.error LoggerMessage.new(controller_name, session[:user].name, 'Timezone not specified', request) if current_user.timezonepref.nil?
flash.now[:error] = 'You have not specified your preferred timezone yet. Please do this before you set up the deadlines.' if current_user.timezonepref.nil?
end- Read upRead up
- Exclude checks
This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric
Missing top-level class documentation comment. Open
class AssignmentsController < ApplicationController- Read upRead up
- Exclude checks
This cop checks for missing top-level documentation of classes and modules. Classes with no body are exempt from the check and so are namespace modules - modules that have nothing in their bodies except classes, other modules, or constant definitions.
The documentation requirement is annulled if the class or module has a "#:nodoc:" comment next to it. Likewise, "#:nodoc: all" does the same for all its children.
Example:
# bad
class Person
# ...
end
# good
# Description/Explanation of Person class
class Person
# ...
endUse a guard clause instead of wrapping the code inside a conditional expression. Open
if current_user.timezonepref.nil?- Read upRead up
- Exclude checks
Use a guard clause instead of wrapping the code inside a conditional expression
Example:
# bad
def test
if something
work
end
end
# good
def test
return unless something
work
end
# also good
def test
work if something
end
# bad
if something
raise 'exception'
else
ok
end
# good
raise 'exception' if something
okUse a guard clause instead of wrapping the code inside a conditional expression. Open
if assignment.participants.empty?- Read upRead up
- Exclude checks
Use a guard clause instead of wrapping the code inside a conditional expression
Example:
# bad
def test
if something
work
end
end
# good
def test
return unless something
work
end
# also good
def test
work if something
end
# bad
if something
raise 'exception'
else
ok
end
# good
raise 'exception' if something
okUse a guard clause instead of wrapping the code inside a conditional expression. Open
if !list_unassigned_rubrics.empty? && request.original_fullpath == "/assignments/#{@assignment_form.assignment.id}/edit"- Read upRead up
- Exclude checks
Use a guard clause instead of wrapping the code inside a conditional expression
Example:
# bad
def test
if something
work
end
end
# good
def test
return unless something
work
end
# also good
def test
work if something
end
# bad
if something
raise 'exception'
else
ok
end
# good
raise 'exception' if something
ok