RubyGems · rubygems.org
rubocop-rails
DNS / OAST exfiltration: matched "dig each except exclude? extract! fetch has_key? has_value?\n include? inspect instance_of? is_a? keep_if key? keys kind_of? member? merge merge!\n nil? presence present? reverse_merge reverse_merge! slice stringify_keys\n to_a to_f to_h to_hash to_i to_s to_unsafe_h to_unsafe_hash\n transform_keys transform_keys! transform_values transform_values! try try!\n value? values values_at with_defaults with_defaults! without\n ].freeze\n RAISING_FINDER_METHODS = %i[find find_by! find_sole_by].freeze\n\n minimum_target_rails_version 8.0\n\n def_node_matcher :params_bracket_access, <<~PATTERN\n (send (send nil? :params) :[] $_)\n PATTERN\n\n # `require` with an array literal expects multiple top-level keys and has no single `expect` equivalent,\n # so such calls are excluded to avoid generating broken code.\n # A single dynamic argument to `permit` (such as a method call or variable that may return an array)\n # has no safe `expect` rewrite, because the cop cannot tell whether the value is a list of attributes\n # or a nested hash. Such calls are excluded to avoid generating broken code.\n def_node_matcher :params_require_permit, <<~PATTERN\n [\n $(call\n $(call\n (send nil? :params) :require !array) :permit _+)\n !(call _ :permit {call lvar ivar cvar gvar const})\n ]\n PATTERN\n\n def_node_matcher :params_permit_require, <<~PATTERN\n $(call\n $("
Why PkgRadar flagged 2.35.4
| Severity | Signal | Evidence |
|---|---|---|
| high | DNS / OAST exfiltration | matched "dig each except exclude? extract! fetch has_key? has_value?\n include? inspect instance_of? is_a? keep_if key? keys kind_of? member? merge merge!\n nil? presence present? reverse_merge reverse_merge! slice stringify_keys\n to_a to_f to_h to_hash to_i to_s to_unsafe_h to_unsafe_hash\n transform_keys transform_keys! transform_values transform_values! try try!\n value? values values_at with_defaults with_defaults! without\n ].freeze\n RAISING_FINDER_METHODS = %i[find find_by! find_sole_by].freeze\n\n minimum_target_rails_version 8.0\n\n def_node_matcher :params_bracket_access, <<~PATTERN\n (send (send nil? :params) :[] $_)\n PATTERN\n\n # `require` with an array literal expects multiple top-level keys and has no single `expect` equivalent,\n # so such calls are excluded to avoid generating broken code.\n # A single dynamic argument to `permit` (such as a method call or variable that may return an array)\n # has no safe `expect` rewrite, because the cop cannot tell whether the value is a list of attributes\n # or a nested hash. Such calls are excluded to avoid generating broken code.\n def_node_matcher :params_require_permit, <<~PATTERN\n [\n $(call\n $(call\n (send nil? :params) :require !array) :permit _+)\n !(call _ :permit {call lvar ivar cvar gvar const})\n ]\n PATTERN\n\n def_node_matcher :params_permit_require, <<~PATTERN\n $(call\n $(" · lib/rubocop/cop/rails/strong_parameters_expect.rb |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
2.35.4 | High risk | 15 | 2026-06-07 |
2.35.3 | High risk | 15 | 2026-05-30 |
Block this in CI
pkgradar gate --ecosystem rubygems [email protected]