PkgRadar

RubyGems · rubygems.org

rubocop-rails

DNS / OAST exfiltration: matched "dig each except exclude? extract! fetch has_key? has_value?\n include? inspect instance_of? is_a? keep_if key? keys kind_of? member? merge merge!\n nil? presence present? reverse_merge reverse_merge! slice stringify_keys\n to_a to_f to_h to_hash to_i to_s to_unsafe_h to_unsafe_hash\n transform_keys transform_keys! transform_values transform_values! try try!\n value? values values_at with_defaults with_defaults! without\n ].freeze\n RAISING_FINDER_METHODS = %i[find find_by! find_sole_by].freeze\n\n minimum_target_rails_version 8.0\n\n def_node_matcher :params_bracket_access, <<~PATTERN\n (send (send nil? :params) :[] $_)\n PATTERN\n\n # `require` with an array literal expects multiple top-level keys and has no single `expect` equivalent,\n # so such calls are excluded to avoid generating broken code.\n # A single dynamic argument to `permit` (such as a method call or variable that may return an array)\n # has no safe `expect` rewrite, because the cop cannot tell whether the value is a list of attributes\n # or a nested hash. Such calls are excluded to avoid generating broken code.\n def_node_matcher :params_require_permit, <<~PATTERN\n [\n $(call\n $(call\n (send nil? :params) :require !array) :permit _+)\n !(call _ :permit {call lvar ivar cvar gvar const})\n ]\n PATTERN\n\n def_node_matcher :params_permit_require, <<~PATTERN\n $(call\n $("

Why PkgRadar flagged 2.35.4

SeveritySignalEvidence
highDNS / OAST exfiltrationmatched "dig each except exclude? extract! fetch has_key? has_value?\n include? inspect instance_of? is_a? keep_if key? keys kind_of? member? merge merge!\n nil? presence present? reverse_merge reverse_merge! slice stringify_keys\n to_a to_f to_h to_hash to_i to_s to_unsafe_h to_unsafe_hash\n transform_keys transform_keys! transform_values transform_values! try try!\n value? values values_at with_defaults with_defaults! without\n ].freeze\n RAISING_FINDER_METHODS = %i[find find_by! find_sole_by].freeze\n\n minimum_target_rails_version 8.0\n\n def_node_matcher :params_bracket_access, <<~PATTERN\n (send (send nil? :params) :[] $_)\n PATTERN\n\n # `require` with an array literal expects multiple top-level keys and has no single `expect` equivalent,\n # so such calls are excluded to avoid generating broken code.\n # A single dynamic argument to `permit` (such as a method call or variable that may return an array)\n # has no safe `expect` rewrite, because the cop cannot tell whether the value is a list of attributes\n # or a nested hash. Such calls are excluded to avoid generating broken code.\n def_node_matcher :params_require_permit, <<~PATTERN\n [\n $(call\n $(call\n (send nil? :params) :require !array) :permit _+)\n !(call _ :permit {call lvar ivar cvar gvar const})\n ]\n PATTERN\n\n def_node_matcher :params_permit_require, <<~PATTERN\n $(call\n $(" · lib/rubocop/cop/rails/strong_parameters_expect.rb

Scanned versions

VersionVerdictScoreScanned (UTC)
2.35.4High risk152026-06-07
2.35.3High risk152026-05-30

Block this in CI

PkgRadar gates rubocop-rails (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem rubygems [email protected]