diff --git a/.rubocop_todo.yml b/.rubocop_todo.yml index 58a01c64..a993853a 100644 --- a/.rubocop_todo.yml +++ b/.rubocop_todo.yml @@ -1,6 +1,6 @@ # This configuration was generated by # `rubocop --auto-gen-config --exclude-limit 180` -# on 2023-03-17 23:33:42 UTC using RuboCop version 1.48.1. +# on 2023-03-22 23:33:34 UTC using RuboCop version 1.48.1. # The point is for the user to remove these configuration records # one by one as the offenses are removed from the code base. # Note that changes in the inspected code, or installation of new @@ -711,13 +711,6 @@ Lint/IdentityComparison: Exclude: - 'spec/lib/swagger/swagger_dsl_spec.rb' -# Offense count: 5 -Lint/MissingSuper: - Exclude: - - 'lib/apipie/errors.rb' - - 'lib/apipie/response_description_adapter.rb' - - 'lib/apipie/validator.rb' - # Offense count: 11 # This cop supports unsafe autocorrection (--autocorrect-all). Lint/NonAtomicFileOperation: @@ -971,11 +964,10 @@ Performance/RedundantMerge: - 'lib/apipie/generator/swagger/param_description/type.rb' - 'lib/apipie/middleware/checksum_in_headers.rb' -# Offense count: 8 +# Offense count: 7 # This cop supports safe autocorrection (--autocorrect). Performance/RegexpMatch: Exclude: - - 'app/controllers/apipie/apipies_controller.rb' - 'lib/apipie/extractor/writer.rb' - 'lib/apipie/helpers.rb' @@ -987,12 +979,6 @@ Performance/StringIdentifierArgument: - 'spec/controllers/users_controller_spec.rb' - 'spec/lib/apipie/method_description_spec.rb' -# Offense count: 2 -# This cop supports unsafe autocorrection (--autocorrect-all). -Performance/StringInclude: - Exclude: - - 'app/controllers/apipie/apipies_controller.rb' - # Offense count: 7 # This cop supports safe autocorrection (--autocorrect). Performance/StringReplacement: @@ -1218,7 +1204,7 @@ RSpec/MessageSpies: RSpec/MultipleExpectations: Max: 19 -# Offense count: 64 +# Offense count: 66 # Configuration parameters: AllowSubject. RSpec/MultipleMemoizedHelpers: Max: 15 @@ -1676,153 +1662,6 @@ Style/For: Style/FormatStringToken: EnforcedStyle: template -# Offense count: 140 -# This cop supports unsafe autocorrection (--autocorrect-all). -# Configuration parameters: EnforcedStyle. -# SupportedStyles: always, always_true, never -Style/FrozenStringLiteralComment: - Exclude: - - 'Rakefile' - - 'apipie-rails.gemspec' - - 'app/controllers/apipie/apipies_controller.rb' - - 'app/helpers/apipie_helper.rb' - - 'lib/apipie-rails.rb' - - 'lib/apipie/apipie_module.rb' - - 'lib/apipie/application.rb' - - 'lib/apipie/configuration.rb' - - 'lib/apipie/core_ext/route.rb' - - 'lib/apipie/dsl_definition.rb' - - 'lib/apipie/error_description.rb' - - 'lib/apipie/errors.rb' - - 'lib/apipie/extractor.rb' - - 'lib/apipie/extractor/collector.rb' - - 'lib/apipie/extractor/recorder.rb' - - 'lib/apipie/extractor/writer.rb' - - 'lib/apipie/generator/generator.rb' - - 'lib/apipie/generator/swagger/context.rb' - - 'lib/apipie/generator/swagger/operation_id.rb' - - 'lib/apipie/generator/swagger/param_description.rb' - - 'lib/apipie/generator/swagger/param_description/builder.rb' - - 'lib/apipie/generator/swagger/param_description/composite.rb' - - 'lib/apipie/generator/swagger/param_description/description.rb' - - 'lib/apipie/generator/swagger/param_description/in.rb' - - 'lib/apipie/generator/swagger/param_description/name.rb' - - 'lib/apipie/generator/swagger/param_description/type.rb' - - 'lib/apipie/generator/swagger/swagger.rb' - - 'lib/apipie/generator/swagger/type.rb' - - 'lib/apipie/generator/swagger/type_extractor.rb' - - 'lib/apipie/generator/swagger/warning.rb' - - 'lib/apipie/generator/swagger/warning_writer.rb' - - 'lib/apipie/helpers.rb' - - 'lib/apipie/markup.rb' - - 'lib/apipie/method_description.rb' - - 'lib/apipie/method_description/api.rb' - - 'lib/apipie/method_description/apis_service.rb' - - 'lib/apipie/middleware/checksum_in_headers.rb' - - 'lib/apipie/param_description.rb' - - 'lib/apipie/railtie.rb' - - 'lib/apipie/resource_description.rb' - - 'lib/apipie/response_description.rb' - - 'lib/apipie/response_description_adapter.rb' - - 'lib/apipie/routes_formatter.rb' - - 'lib/apipie/routing.rb' - - 'lib/apipie/rspec/response_validation_helper.rb' - - 'lib/apipie/see_description.rb' - - 'lib/apipie/static_dispatcher.rb' - - 'lib/apipie/swagger_generator.rb' - - 'lib/apipie/tag_list_description.rb' - - 'lib/apipie/validator.rb' - - 'lib/apipie/version.rb' - - 'lib/generators/apipie/install/install_generator.rb' - - 'lib/generators/apipie/views_generator.rb' - - 'lib/tasks/apipie.rake' - - 'spec/controllers/api/v1/architectures_controller_spec.rb' - - 'spec/controllers/api/v2/architectures_controller_spec.rb' - - 'spec/controllers/api/v2/nested/resources_controller_spec.rb' - - 'spec/controllers/concerns_controller_spec.rb' - - 'spec/controllers/extended_controller_spec.rb' - - 'spec/controllers/included_param_group_controller_spec.rb' - - 'spec/controllers/pets_controller_spec.rb' - - 'spec/controllers/users_controller_spec.rb' - - 'spec/dummy/Rakefile' - - 'spec/dummy/app/controllers/api/base_controller.rb' - - 'spec/dummy/app/controllers/api/v1/architectures_controller.rb' - - 'spec/dummy/app/controllers/api/v1/base_controller.rb' - - 'spec/dummy/app/controllers/api/v2/architectures_controller.rb' - - 'spec/dummy/app/controllers/api/v2/base_controller.rb' - - 'spec/dummy/app/controllers/api/v2/nested/architectures_controller.rb' - - 'spec/dummy/app/controllers/api/v2/nested/resources_controller.rb' - - 'spec/dummy/app/controllers/application_controller.rb' - - 'spec/dummy/app/controllers/concerns_controller.rb' - - 'spec/dummy/app/controllers/extended_controller.rb' - - 'spec/dummy/app/controllers/extending_concern.rb' - - 'spec/dummy/app/controllers/files_controller.rb' - - 'spec/dummy/app/controllers/included_param_group_controller.rb' - - 'spec/dummy/app/controllers/overridden_concerns_controller.rb' - - 'spec/dummy/app/controllers/pets_controller.rb' - - 'spec/dummy/app/controllers/pets_using_auto_views_controller.rb' - - 'spec/dummy/app/controllers/pets_using_self_describing_classes_controller.rb' - - 'spec/dummy/app/controllers/sample_controller.rb' - - 'spec/dummy/app/controllers/tagged_cats_controller.rb' - - 'spec/dummy/app/controllers/tagged_dogs_controller.rb' - - 'spec/dummy/app/controllers/twitter_example_controller.rb' - - 'spec/dummy/app/controllers/users_controller.rb' - - 'spec/dummy/app/helpers/random_param_group.rb' - - 'spec/dummy/components/test_engine/Gemfile' - - 'spec/dummy/components/test_engine/app/controllers/test_engine/application_controller.rb' - - 'spec/dummy/components/test_engine/app/controllers/test_engine/memes_controller.rb' - - 'spec/dummy/components/test_engine/config/routes.rb' - - 'spec/dummy/components/test_engine/lib/test_engine.rb' - - 'spec/dummy/components/test_engine/test_engine.gemspec' - - 'spec/dummy/config.ru' - - 'spec/dummy/config/application.rb' - - 'spec/dummy/config/boot.rb' - - 'spec/dummy/config/environment.rb' - - 'spec/dummy/config/environments/development.rb' - - 'spec/dummy/config/environments/production.rb' - - 'spec/dummy/config/environments/test.rb' - - 'spec/dummy/config/initializers/apipie.rb' - - 'spec/dummy/config/initializers/backtrace_silencers.rb' - - 'spec/dummy/config/initializers/inflections.rb' - - 'spec/dummy/config/initializers/mime_types.rb' - - 'spec/dummy/config/initializers/secret_token.rb' - - 'spec/dummy/config/initializers/session_store.rb' - - 'spec/dummy/config/routes.rb' - - 'spec/dummy/script/rails' - - 'spec/lib/apipie/apipies_controller_spec.rb' - - 'spec/lib/apipie/application_spec.rb' - - 'spec/lib/apipie/extractor/recorder/middleware_spec.rb' - - 'spec/lib/apipie/extractor/writer_spec.rb' - - 'spec/lib/apipie/extractor_spec.rb' - - 'spec/lib/apipie/file_handler_spec.rb' - - 'spec/lib/apipie/generator/swagger/context_spec.rb' - - 'spec/lib/apipie/generator/swagger/operation_id_spec.rb' - - 'spec/lib/apipie/generator/swagger/param_description/builder_spec.rb' - - 'spec/lib/apipie/generator/swagger/param_description/composite_spec.rb' - - 'spec/lib/apipie/generator/swagger/param_description/description_spec.rb' - - 'spec/lib/apipie/generator/swagger/param_description/in_spec.rb' - - 'spec/lib/apipie/generator/swagger/param_description/name_spec.rb' - - 'spec/lib/apipie/generator/swagger/param_description/type_spec.rb' - - 'spec/lib/apipie/generator/swagger/param_description_spec.rb' - - 'spec/lib/apipie/generator/swagger/type_extractor_spec.rb' - - 'spec/lib/apipie/generator/swagger/warning_spec.rb' - - 'spec/lib/apipie/generator/swagger/warning_writer_spec.rb' - - 'spec/lib/apipie/method_description/apis_service_spec.rb' - - 'spec/lib/apipie/method_description_spec.rb' - - 'spec/lib/apipie/param_description/deprecation_spec.rb' - - 'spec/lib/apipie/param_description_spec.rb' - - 'spec/lib/apipie/param_group_spec.rb' - - 'spec/lib/apipie/resource_description_spec.rb' - - 'spec/lib/apipie/validator_spec.rb' - - 'spec/lib/rake_spec.rb' - - 'spec/lib/swagger/rake_swagger_spec.rb' - - 'spec/lib/swagger/swagger_dsl_spec.rb' - - 'spec/lib/validators/array_validator_spec.rb' - - 'spec/spec_helper.rb' - - 'spec/support/custom_bool_validator.rb' - - 'spec/support/rake.rb' - - 'spec/test_engine/memes_controller_spec.rb' - # Offense count: 34 # This cop supports safe autocorrection (--autocorrect). # Configuration parameters: MinBodyLength, AllowConsecutiveConditionals. diff --git a/app/controllers/apipie/apipies_controller.rb b/app/controllers/apipie/apipies_controller.rb index c669feae..746f2f3e 100644 --- a/app/controllers/apipie/apipies_controller.rb +++ b/app/controllers/apipie/apipies_controller.rb @@ -155,7 +155,7 @@ def get_format def render_from_cache path = Apipie.configuration.doc_base_url.dup # some params can contain dot, but only one in row - if [:resource, :method, :format, :version].any? { |p| params[p].to_s.gsub(".", "") =~ /\W/ || params[p].to_s =~ /\.\./ } + if [:resource, :method, :format, :version].any? { |p| params[p].to_s.gsub(".", "") =~ /\W/ || params[p].to_s.include?('..') } head :bad_request and return end @@ -171,7 +171,7 @@ def render_from_cache # we sanitize the params before so in ideal case, this condition # will be never satisfied. It's here for cases somebody adds new # param into the path later and forgets about sanitation. - if path =~ /\.\./ + if path.include?('..') head :bad_request and return end