Add Security/Marshal cop

CHANGELOG.md

@@ -4,6 +4,7 @@
 
 ### New features
 
+* [#3816](https://github.com/bbatsov/rubocop/pull/3816): Add `Security/MarshalLoad` cop. ([@cyberdelia][])
 * [#3757](https://github.com/bbatsov/rubocop/pull/3757): Add Auto-Correct for `Bundler/OrderedGems` cop. ([@pocke][])
 * `Style/FrozenStringLiteralComment` now supports the style `never` that will remove the `frozen_string_literal` comment. ([@rrosenblum][])
 * [#3795](https://github.com/bbatsov/rubocop/pull/3795): Add `Lint/MultipleCompare` cop. ([@pocke][])
@@ -2343,6 +2344,7 @@
 [@pmenglund]: https://github.com/pmenglund
 [@chulkilee]: https://github.com/chulkilee
 [@codez]: https://github.com/codez
+[@cyberdelia]: https://github.com/cyberdelia
 [@emou]: https://github.com/emou
 [@skanev]: http://github.com/skanev
 [@claco]: http://github.com/claco

config/enabled.yml

@@ -1573,6 +1573,13 @@ Security/JSONLoad:
   # on the value of the argument.
   AutoCorrect: false
 
+Security/MarshalLoad:
+  Description: >-
+                 Avoid using of `Marshal.load` or `Marshal.restore` due to potential
+                 security issues. See reference for more information.
+  Reference: 'http://ruby-doc.org/core-2.3.3/Marshal.html#module-Marshal-label-Security+considerations'
+  Enabled: true
+
 ##################### Bundler #############################
 
 Bundler/DuplicatedGem:

lib/rubocop.rb

@@ -420,6 +420,7 @@
 require 'rubocop/cop/rails/validation'
 
 require 'rubocop/cop/security/json_load'
+require 'rubocop/cop/security/marshal_load'
 
 require 'rubocop/cop/team'
 

lib/rubocop/cop/security/marshal_load.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Security
+      # This cop checks for the use of Marshal class methods which have
+      # potential security issues leading to remote code execution when
+      # loading from an untrusted source.
+      #
+      # @example
+      #   # bad
+      #   Marshal.load("{}")
+      #   Marshal.restore("{}")
+      #
+      #   # good
+      #   Marshal.dump("{}")
+      #
+      class MarshalLoad < Cop
+        MSG = 'Avoid using `Marshal.%s`.'.freeze
+
+        def_node_matcher :marshal_load, <<-END
+          (send (const nil :Marshal) ${:load :restore} ...)
+        END
+
+        def on_send(node)
+          marshal_load(node) do |method|
+            add_offense(node, :selector, format(MSG, method))
+          end
+        end
+      end
+    end
+  end
+end

manual/cops.md

@@ -201,6 +201,7 @@ In the following section you find all available cops:
 #### Type [Security](cops_security.md)
 
 * [Security/JSONLoad](cops_security.md#securityjsonload)
+* [Security/MarshalLoad](cops_security.md#securitymarshalload)
 
 #### Type [Style](cops_style.md)
 

manual/cops_security.md

@@ -35,3 +35,31 @@ Attribute | Value
 Reference | http://ruby-doc.org/stdlib-2.3.0/libdoc/json/rdoc/JSON.html#method-i-load
 AutoCorrect | false
 
+
+## Security/MarshalLoad
+
+Enabled by default | Supports autocorrection
+--- | ---
+Enabled | No
+
+This cop checks for the use of Marshal class methods which have
+potential security issues leading to remote code execution when
+loading from an untrusted source.
+
+### Example
+
+```ruby
+# bad
+Marshal.load("{}")
+Marshal.restore("{}")
+
+# good
+Marshal.dump("{}")
+```
+
+### Important attributes
+
+Attribute | Value
+--- | ---
+Reference | http://ruby-doc.org/core-2.3.3/Marshal.html#module-Marshal-label-Security+considerations
+

manual/cops_style.md

@@ -650,6 +650,7 @@ Attribute | Value
 EnforcedStyle | assign_to_condition
 SupportedStyles | assign_to_condition, assign_inside_condition
 SingleLineConditionsOnly | true
+IncludeTernaryExpressions | true
 
 
 ## Style/ConstantName

spec/rubocop/cop/security/json_load_spec.rb

@@ -10,7 +10,7 @@
     expect(cop.offenses).to be_empty
   end
 
-  it 'accepts JSON.parse' do
+  it 'accepts Module::JSON.parse' do
     inspect_source(cop, 'Module::JSON.parse("{}")')
     expect(cop.offenses).to be_empty
   end
@@ -20,7 +20,7 @@
     expect(cop.offenses).to be_empty
   end
 
-  it 'accepts JSON.dump' do
+  it 'accepts Module::JSON.dump' do
     inspect_source(cop, 'Module::JSON.load({})')
     expect(cop.offenses).to be_empty
   end

spec/rubocop/cop/security/marshal_load_spec.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe RuboCop::Cop::Security::MarshalLoad, :config do
+  subject(:cop) { described_class.new(config) }
+
+  it 'accepts Marshal.dump' do
+    inspect_source(cop, 'Marshal.dump({})')
+    expect(cop.offenses).to be_empty
+  end
+
+  it 'accepts Module::Marshal.dump' do
+    inspect_source(cop, 'Module::Marshal.dump({})')
+    expect(cop.offenses).to be_empty
+  end
+
+  [:load, :restore].each do |method|
+    it "registers an offense for Marshal.#{method}" do
+      inspect_source(cop, "Marshal.#{method}('{}')")
+      expect(cop.offenses.size).to eq(1)
+      expect(cop.offenses.first.message).to include("Marshal.#{method}")
+    end
+  end
+end