2020-09-04 14:08:48 -04:00
# frozen_string_literal: true
module RuboCop
module Cop
module Gitlab
# This cop checks for `UploadedFile.from_params` usage.
2022-02-28 16:14:01 -05:00
# See https://docs.gitlab.com/ee/development/uploads/working_with_uploads.html
2020-09-04 14:08:48 -04:00
#
# @example
#
# # bad
# class MyAwfulApi < Grape::API::Instance
# params do
# optional 'file.path', type: String
# optional 'file.name', type: String
# optional 'file.type', type: String
# optional 'file.size', type: Integer
# optional 'file.md5', type: String
# optional 'file.sha1', type: String
# optional 'file.sha256', type: String
# end
# put '/files' do
# uploaded_file = UploadedFile.from_params(params, :file, FileUploader.workhorse_local_upload_path)
# end
# end
#
# # good
# class MyMuchBetterApi < Grape::API::Instance
# params do
# requires :file, type: ::API::Validations::Types::WorkhorseFile
# end
# put '/files' do
# uploaded_file = declared_params[:file]
# end
# end
2022-09-14 11:12:56 -04:00
class AvoidUploadedFileFromParams < RuboCop :: Cop :: Base
2022-02-28 16:14:01 -05:00
MSG = 'Use the `UploadedFile` set by `multipart.rb` instead of calling `UploadedFile.from_params` directly. See https://docs.gitlab.com/ee/development/uploads/working_with_uploads.html'
2020-09-04 14:08:48 -04:00
def_node_matcher :calling_uploaded_file_from_params? , << ~ PATTERN
( send ( const nil ? :UploadedFile ) :from_params ... )
PATTERN
def on_send ( node )
return unless calling_uploaded_file_from_params? ( node )
2022-09-14 11:12:56 -04:00
add_offense ( node )
2020-09-04 14:08:48 -04:00
end
end
end
end
end