Possible SQL injection Open
.joins("INNER JOIN (#{results}) AS results ON results.match_id = investors.id")
- Read upRead up
- Create a ticketCreate a ticket
- Exclude checks
Injection is #1 on the 2013 OWASP Top Ten web security risks. SQL injection is when a user is able to manipulate a value which is used unsafely inside a SQL query. This can lead to data leaks, data loss, elevation of privilege, and other unpleasant outcomes.
Brakeman focuses on ActiveRecord methods dealing with building SQL statements.
A basic (Rails 2.x) example looks like this:
User.first(:conditions => "username = '#{params[:username]}'")
Brakeman would produce a warning like this:
Possible SQL injection near line 30: User.first(:conditions => ("username = '#{params[:username]}'"))
The safe way to do this query is to use a parameterized query:
User.first(:conditions => ["username = ?", params[:username]])
Brakeman also understands the new Rails 3.x way of doing things (and local variables and concatenation):
username = params[:user][:name].downcase
password = params[:user][:password]
User.first.where("username = '" + username + "' AND password = '" + password + "'")
This results in this kind of warning:
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
See the Ruby Security Guide for more information and Rails-SQLi.org for many examples of SQL injection in Rails.
Class has too many lines. [476/250] Open
class Investor < ApplicationRecord
extend Concerns::Ignorable
include Concerns::AttributeArrayable
include Concerns::Cacheable
include Concerns::Ignorable
- Read upRead up
- Create a ticketCreate a ticket
- Exclude checks
This cop checks if the length a class exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
Class Investor
has 53 methods (exceeds 20 allowed). Consider refactoring. Open
class Investor < ApplicationRecord
extend Concerns::Ignorable
include Concerns::AttributeArrayable
include Concerns::Cacheable
include Concerns::Ignorable
- Create a ticketCreate a ticket
File investor.rb
has 478 lines of code (exceeds 250 allowed). Consider refactoring. Open
class Investor < ApplicationRecord
extend Concerns::Ignorable
include Concerns::AttributeArrayable
include Concerns::Cacheable
include Concerns::Ignorable
- Create a ticketCreate a ticket
Method crawl_posts!
has a Cognitive Complexity of 19 (exceeds 5 allowed). Consider refactoring. Open
def crawl_posts!
new_posts = fetch_posts!
existing = Set.new Post.where(url: new_posts.map { |p| p[:url] }).pluck(:url)
new_posts.reject { |p| existing.include? p[:url] }.each do |meta|
- Read upRead up
- Create a ticketCreate a ticket
Cognitive Complexity
Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.
A method's cognitive complexity is based on a few simple rules:
- Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
- Code is considered more complex for each "break in the linear flow of the code"
- Code is considered more complex when "flow breaking structures are nested"
Further reading
Method populate_from_cb!
has a Cognitive Complexity of 19 (exceeds 5 allowed). Consider refactoring. Open
def populate_from_cb!
person = crunchbase_person
return unless person.present? && person.found?
self.photo = person.image
- Read upRead up
- Create a ticketCreate a ticket
Cognitive Complexity
Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.
A method's cognitive complexity is based on a few simple rules:
- Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
- Code is considered more complex for each "break in the linear flow of the code"
- Code is considered more complex when "flow breaking structures are nested"
Further reading
Cyclomatic complexity for populate_from_al! is too high. [12/6] Open
def populate_from_al!
return unless angelist_user.present? && angelist_user.found?
self.al_url = angelist_user.angellist_url
- Read upRead up
- Create a ticketCreate a ticket
- Exclude checks
This cop checks that the cyclomatic complexity of methods is not higher than the configured maximum. The cyclomatic complexity is the number of linearly independent paths through a method. The algorithm counts decision points and adds one.
An if statement (or unless or ?:) increases the complexity by one. An else branch does not, since it doesn't add a decision point. The && operator (or keyword and) can be converted to a nested if statement, and ||/or is shorthand for a sequence of ifs, so they also add one. Loops can be said to have an exit condition, so they add one.
Method populate_from_al!
has a Cognitive Complexity of 16 (exceeds 5 allowed). Consider refactoring. Open
def populate_from_al!
return unless angelist_user.present? && angelist_user.found?
self.al_url = angelist_user.angellist_url
- Read upRead up
- Create a ticketCreate a ticket
Cognitive Complexity
Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.
A method's cognitive complexity is based on a few simple rules:
- Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
- Code is considered more complex for each "break in the linear flow of the code"
- Code is considered more complex when "flow breaking structures are nested"
Further reading
Method has too many lines. [33/30] Open
def as_json(options = {})
super options.reverse_merge(
only: [
:id,
:role,
- Read upRead up
- Create a ticketCreate a ticket
- Exclude checks
This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.
Cyclomatic complexity for populate_from_cb_basic! is too high. [9/6] Open
def populate_from_cb_basic!
person = crunchbase_person
return unless person.present? && person.found?
self.first_name = person.first_name
- Read upRead up
- Create a ticketCreate a ticket
- Exclude checks
This cop checks that the cyclomatic complexity of methods is not higher than the configured maximum. The cyclomatic complexity is the number of linearly independent paths through a method. The algorithm counts decision points and adds one.
An if statement (or unless or ?:) increases the complexity by one. An else branch does not, since it doesn't add a decision point. The && operator (or keyword and) can be converted to a nested if statement, and ||/or is shorthand for a sequence of ifs, so they also add one. Loops can be said to have an exit condition, so they add one.
Cyclomatic complexity for populate_from_cb! is too high. [8/6] Open
def populate_from_cb!
person = crunchbase_person
return unless person.present? && person.found?
self.photo = person.image
- Read upRead up
- Create a ticketCreate a ticket
- Exclude checks
This cop checks that the cyclomatic complexity of methods is not higher than the configured maximum. The cyclomatic complexity is the number of linearly independent paths through a method. The algorithm counts decision points and adds one.
An if statement (or unless or ?:) increases the complexity by one. An else branch does not, since it doesn't add a decision point. The && operator (or keyword and) can be converted to a nested if statement, and ||/or is shorthand for a sequence of ifs, so they also add one. Loops can be said to have an exit condition, so they add one.
Cyclomatic complexity for save_and_fix_duplicates! is too high. [8/6] Open
def save_and_fix_duplicates!
begin
self.save! if self.changed?
rescue ActiveRecord::RecordInvalid => e
raise unless e.record.errors.details.all? { |k,v| v.all? { |e| e[:error].to_sym == :taken } }
- Read upRead up
- Create a ticketCreate a ticket
- Exclude checks
This cop checks that the cyclomatic complexity of methods is not higher than the configured maximum. The cyclomatic complexity is the number of linearly independent paths through a method. The algorithm counts decision points and adds one.
An if statement (or unless or ?:) increases the complexity by one. An else branch does not, since it doesn't add a decision point. The && operator (or keyword and) can be converted to a nested if statement, and ||/or is shorthand for a sequence of ifs, so they also add one. Loops can be said to have an exit condition, so they add one.
Cyclomatic complexity for crawl_posts! is too high. [7/6] Open
def crawl_posts!
new_posts = fetch_posts!
existing = Set.new Post.where(url: new_posts.map { |p| p[:url] }).pluck(:url)
new_posts.reject { |p| existing.include? p[:url] }.each do |meta|
- Read upRead up
- Create a ticketCreate a ticket
- Exclude checks
This cop checks that the cyclomatic complexity of methods is not higher than the configured maximum. The cyclomatic complexity is the number of linearly independent paths through a method. The algorithm counts decision points and adds one.
An if statement (or unless or ?:) increases the complexity by one. An else branch does not, since it doesn't add a decision point. The && operator (or keyword and) can be converted to a nested if statement, and ||/or is shorthand for a sequence of ifs, so they also add one. Loops can be said to have an exit condition, so they add one.
Method save_and_fix_duplicates!
has a Cognitive Complexity of 13 (exceeds 5 allowed). Consider refactoring. Open
def save_and_fix_duplicates!
begin
self.save! if self.changed?
rescue ActiveRecord::RecordInvalid => e
raise unless e.record.errors.details.all? { |k,v| v.all? { |e| e[:error].to_sym == :taken } }
- Read upRead up
- Create a ticketCreate a ticket
Cognitive Complexity
Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.
A method's cognitive complexity is based on a few simple rules:
- Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
- Code is considered more complex for each "break in the linear flow of the code"
- Code is considered more complex when "flow breaking structures are nested"
Further reading
Method as_json
has 33 lines of code (exceeds 25 allowed). Consider refactoring. Open
def as_json(options = {})
super options.reverse_merge(
only: [
:id,
:role,
- Create a ticketCreate a ticket
Method populate_from_cb_basic!
has a Cognitive Complexity of 11 (exceeds 5 allowed). Consider refactoring. Open
def populate_from_cb_basic!
person = crunchbase_person
return unless person.present? && person.found?
self.first_name = person.first_name
- Read upRead up
- Create a ticketCreate a ticket
Cognitive Complexity
Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.
A method's cognitive complexity is based on a few simple rules:
- Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
- Code is considered more complex for each "break in the linear flow of the code"
- Code is considered more complex when "flow breaking structures are nested"
Further reading
Method fetch_posts!
has a Cognitive Complexity of 9 (exceeds 5 allowed). Consider refactoring. Open
def fetch_posts!
return [] unless blog_url.present?
body = Http::Fetch.get_one blog_url
return [] unless body.present?
feed_url = MetaInspector.new(blog_url, document: body).feed
- Read upRead up
- Create a ticketCreate a ticket
Cognitive Complexity
Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.
A method's cognitive complexity is based on a few simple rules:
- Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
- Code is considered more complex for each "break in the linear flow of the code"
- Code is considered more complex when "flow breaking structures are nested"
Further reading
Method fetch_news!
has a Cognitive Complexity of 9 (exceeds 5 allowed). Consider refactoring. Open
def fetch_news!
# news = Http::Bing.news("#{name} + #{competitor.name}").map { |n| [n['url'], n] }.to_h
# Http::Fetch.get(news.keys).each do |url, body|
# next unless body.present?
# next unless name.downcase.in?(body.downcase) || competitor.name.downcase.in?(body.downcase)
- Read upRead up
- Create a ticketCreate a ticket
Cognitive Complexity
Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.
A method's cognitive complexity is based on a few simple rules:
- Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
- Code is considered more complex for each "break in the linear flow of the code"
- Code is considered more complex when "flow breaking structures are nested"
Further reading
Method angelist_user
has a Cognitive Complexity of 7 (exceeds 5 allowed). Consider refactoring. Open
def angelist_user(safe: false)
@angelist_user ||= begin
user = Http::AngelList::User.new al_id
user if user.found?
end if al_id.present?
- Read upRead up
- Create a ticketCreate a ticket
Cognitive Complexity
Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.
A method's cognitive complexity is based on a few simple rules:
- Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
- Code is considered more complex for each "break in the linear flow of the code"
- Code is considered more complex when "flow breaking structures are nested"
Further reading
Method from_addr
has a Cognitive Complexity of 7 (exceeds 5 allowed). Consider refactoring. Open
def self.from_addr(addr)
found = where(email: addr.address).first
return found if found.present?
return nil unless addr.name.present?
first, last = Util.split_name(addr.name)
- Read upRead up
- Create a ticketCreate a ticket
Cognitive Complexity
Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.
A method's cognitive complexity is based on a few simple rules:
- Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
- Code is considered more complex for each "break in the linear flow of the code"
- Code is considered more complex when "flow breaking structures are nested"
Further reading
Method crawl_homepage!
has a Cognitive Complexity of 6 (exceeds 5 allowed). Consider refactoring. Open
def crawl_homepage!
return unless self.homepage.present?
body = Http::Fetch.get_one self.homepage
unless body.present?
self.homepage = nil
- Read upRead up
- Create a ticketCreate a ticket
Cognitive Complexity
Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.
A method's cognitive complexity is based on a few simple rules:
- Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
- Code is considered more complex for each "break in the linear flow of the code"
- Code is considered more complex when "flow breaking structures are nested"
Further reading
Method import_news
has a Cognitive Complexity of 6 (exceeds 5 allowed). Consider refactoring. Open
def import_news(news)
self.competitor.companies.find_each do |company|
if news.body.include?(company.name)
begin
news.update! company: company
- Read upRead up
- Create a ticketCreate a ticket
Cognitive Complexity
Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.
A method's cognitive complexity is based on a few simple rules:
- Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
- Code is considered more complex for each "break in the linear flow of the code"
- Code is considered more complex when "flow breaking structures are nested"
Further reading
Unused block argument - k
. If it's necessary, use _
or _k
as an argument name to indicate that it won't be used. Open
raise unless e.record.errors.details.all? { |k,v| v.all? { |e| e[:error].to_sym == :taken } }
- Read upRead up
- Create a ticketCreate a ticket
- Exclude checks
This cop checks for unused block arguments.
Example:
# bad
do_something do |used, unused|
puts used
end
do_something do |bar|
puts :foo
end
define_method(:foo) do |bar|
puts :baz
end
Example:
#good
do_something do |used, _unused|
puts used
end
do_something do
puts :foo
end
define_method(:foo) do |_bar|
puts :baz
end
Shadowing outer local variable - job
. Open
job = person.affiliated_companies.sort_by(&:updated_at).reverse.find { |job| job.organization.role_investor }
- Read upRead up
- Create a ticketCreate a ticket
- Exclude checks
This cop looks for use of the same name as outer local variables
for block arguments or block local variables.
This is a mimic of the warning
"shadowing outer local variable - foo" from ruby -cw
.
Example:
# bad
def some_method
foo = 1
2.times do |foo| # shadowing outer `foo`
do_something(foo)
end
end
Example:
# good
def some_method
foo = 1
2.times do |bar|
do_something(bar)
end
end
Shadowing outer local variable - e
. Open
raise unless e.record.errors.details.all? { |k,v| v.all? { |e| e[:error].to_sym == :taken } }
- Read upRead up
- Create a ticketCreate a ticket
- Exclude checks
This cop looks for use of the same name as outer local variables
for block arguments or block local variables.
This is a mimic of the warning
"shadowing outer local variable - foo" from ruby -cw
.
Example:
# bad
def some_method
foo = 1
2.times do |foo| # shadowing outer `foo`
do_something(foo)
end
end
Example:
# good
def some_method
foo = 1
2.times do |bar|
do_something(bar)
end
end
Shadowing outer local variable - news
. Open
news = News.where(investor: self, url: url).first_or_initialize(attrs).tap do |news|
- Read upRead up
- Create a ticketCreate a ticket
- Exclude checks
This cop looks for use of the same name as outer local variables
for block arguments or block local variables.
This is a mimic of the warning
"shadowing outer local variable - foo" from ruby -cw
.
Example:
# bad
def some_method
foo = 1
2.times do |foo| # shadowing outer `foo`
do_something(foo)
end
end
Example:
# good
def some_method
foo = 1
2.times do |bar|
do_something(bar)
end
end
Unused block argument - v
. You can omit the argument if you don't care about it. Open
other.update! attrs.transform_values { |v| nil }.merge(email: nil, al_id: nil)
- Read upRead up
- Create a ticketCreate a ticket
- Exclude checks
This cop checks for unused block arguments.
Example:
# bad
do_something do |used, unused|
puts used
end
do_something do |bar|
puts :foo
end
define_method(:foo) do |bar|
puts :baz
end
Example:
#good
do_something do |used, _unused|
puts used
end
do_something do
puts :foo
end
define_method(:foo) do |_bar|
puts :baz
end