Insufficient validation for 'login' using /^[^\s]+$/. Use \A and \z as anchors Open
validates :login, format: { with: /^[^\s]+$/ }- Read upRead up
- Exclude checks
Calls to validates_format_of ..., :with => // which do not use \A and \z as anchors will cause this warning. Using ^ and $ is not sufficient, as they will only match up to a new line. This allows an attacker to put whatever malicious input they would like before or after a new line character.
See the Ruby Security Guide for details.
Mass assignment is not restricted using attr_accessible Open
class User < ActiveRecord::Base- Read upRead up
- Exclude checks
This warning comes up if a model does not limit what attributes can be set through mass assignment.
In particular, this check looks for attr_accessible inside model definitions. If it is not found, this warning will be issued.
Brakeman also warns on use of attr_protected - especially since it was found to be vulnerable to bypass. Warnings for mass assignment on models using attr_protected will be reported, but at a lower confidence level.
Note that disabling mass assignment globally will suppress these warnings.
Class has too many lines. [216/100] Open
class User < ActiveRecord::Base
# imports are processes to bring in content to a basket
# they specify a topic type of thing they are importing
# or a topic type for the item that relates groups of things
# that they are importing- Read upRead up
- Exclude checks
This cop checks if the length a class exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
Class User has 34 methods (exceeds 20 allowed). Consider refactoring. Open
class User < ActiveRecord::Base
# imports are processes to bring in content to a basket
# they specify a topic type of thing they are importing
# or a topic type for the item that relates groups of things
# that they are importingMethod has too many lines. [14/10] Open
def basket_permissions
permissions = roles.where(authorizable_type: 'Basket')
.select('roles.id AS role_id, roles.name AS role_name, baskets.id AS basket_id, baskets.urlified_name AS basket_urlified_name, baskets.name AS basket_name')
.joins('INNER JOIN baskets on roles.authorizable_id = baskets.id')
- Read upRead up
- Exclude checks
This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
Method has too many lines. [14/10] Open
def distinct_contributions
@distinct_contributions = []
ZOOM_CLASSES.each do |zoom_class|
send("created_#{zoom_class.tableize}".to_sym).each do |contribution|
unless @distinct_contributions.include?(contribution)- Read upRead up
- Exclude checks
This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
Method distinct_contributions has a Cognitive Complexity of 8 (exceeds 5 allowed). Consider refactoring. Open
def distinct_contributions
@distinct_contributions = []
ZOOM_CLASSES.each do |zoom_class|
send("created_#{zoom_class.tableize}".to_sym).each do |contribution|
unless @distinct_contributions.include?(contribution)- Read upRead up
Cognitive Complexity
Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.
A method's cognitive complexity is based on a few simple rules:
- Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
- Code is considered more complex for each "break in the linear flow of the code"
- Code is considered more complex when "flow breaking structures are nested"
Further reading
TODO found Open
# TODO: Clean this up.- Exclude checks
Rename has_been_activated? to been_activated?. Open
def has_been_activated?- Read upRead up
- Exclude checks
This cop makes sure that predicates are named properly.
Example:
# bad
def is_even?(value)
end
# good
def even?(value)
end
# bad
def has_value?
end
# good
def value?
endUse safe navigation (&.) instead of checking if an object exists before calling the method. Open
u && u.authenticated?(password) && u.banned_at.nil? ? u : nil- Read upRead up
- Exclude checks
This cop transforms usages of a method call safeguarded by a non nil
check for the variable whose method is being called to
safe navigation (&.).
Configuration option: ConvertCodeThatCanStartToReturnNil
The default for this is false. When configured to true, this will
check for code in the format !foo.nil? && foo.bar. As it is written,
the return of this code is limited to false and whatever the return
of the method is. If this is converted to safe navigation,
foo&.bar can start returning nil as well as what the method
returns.
Example:
# bad
foo.bar if foo
foo.bar(param1, param2) if foo
foo.bar { |e| e.something } if foo
foo.bar(param) { |e| e.something } if foo
foo.bar if !foo.nil?
foo.bar unless !foo
foo.bar unless foo.nil?
foo && foo.bar
foo && foo.bar(param1, param2)
foo && foo.bar { |e| e.something }
foo && foo.bar(param) { |e| e.something }
# good
foo&.bar
foo&.bar(param1, param2)
foo&.bar { |e| e.something }
foo&.bar(param) { |e| e.something }
foo.nil? || foo.bar
!foo || foo.bar
# Methods that `nil` will `respond_to?` should not be converted to
# use safe navigation
foo.to_i if foo