One Easy Way to Improve Your Ruby Security

Many people in the Ruby community have heard of Rubocop, and likely have some sort of love/hate relationship with it. If you haven't heard of this often polarizing gem, here is the gist of what it does straight from the Rubocop docs.

RuboCop is a Ruby static code analyzer (a.k.a. linter) and code formatter. Out of the box it will enforce many of the guidelines outlined in the community Ruby Style Guide.

However, Rubocop is not just for enforcing style guidelines. Did you know you can use Rubocop to enforce security best practices?!

YEP! That's right! Rubocop has a built in set of Security Cops that can help you write more secure Ruby and Rails code. The cops are:

• Security/Eval- The use of eval represents a serious security risk.
• Security/JSONLoad - Prefer usage of JSON.parse over JSON.load due to potential security issues. See ruby docs for more information.
• Security/MarshalLoad - Avoid using of Marshal.load or Marshal.restore due to potential security issues. See ruby docs for more information.
• Security/Open - The use of Kernel#open represents a serious security risk.
• Security/YAMLLoad - Prefer usage of YAML.safe_load over YAML.load due to potential security issues. See ruby docs for more information.

In addition to the security cops, there are also a couple of other cops that can improve your code security.

• Rails/OutputSafety - The use of html_safe or raw may be a security risk. Often using these can lead to a cross site scripting vulnerability.
• Style/MutableConstant - Do not assign mutable objects to constants. The security implications of this might be less obvious. For example, if you accidentally update a constant with say user data , and then that constant gets used for another user, suddenly you have a data leak. For this reason, it's best to ensure constants are always immutable.

How to Enable ONLY the Security Cops

If you want to use Rubocop just for the security cops, and not those pesky style cops 😉, here is how you would set it up. First, you need to install the gem.

gem install rubocop

Or if you are using a Gemfile...

gem 'rubocop', require: false

Once the gem is installed you will want to configure it with a rubocop.yml file in your home directory. To just enable the security focused cops your yaml file should look like this 👇

AllCops:
  DisabledByDefault: true

Rails/OutputSafety:
  Enabled: true

Security:
  Enabled: true

Style/MutableConstant:
  Enabled: true

Then all you have to do is run it!

$ rubocop

For more tips on basic usage checkout the rubocop docs.

Happy Coding! 😃