Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update rubocop to .49 to fix CVE-2017-8418 #174

Merged
merged 5 commits into from
May 8, 2018

Conversation

matthewalbani
Copy link
Contributor

update rubocop to fix vuln CVE-2017-8418

rubocop/rubocop#4336

@indirect
Copy link
Member

@matthewalbani awesome, thank you! do you think you could add your squareup email to your github account, so these commits are attributed to you correctly?

@matthewalbani
Copy link
Contributor Author

should be added now. Let me know if you want any of the changes undone and added to the skip list

@indirect
Copy link
Member

@bundlerbot r+

@bundlerbot
Copy link
Contributor

📌 Commit 5566b90 has been approved by indirect

@bundlerbot
Copy link
Contributor

⌛ Testing commit 5566b90 with merge d7f5b30...

bundlerbot added a commit that referenced this pull request Jan 18, 2018
@matthewalbani
Copy link
Contributor Author

looks like this one broke some tests

lib/gemstash/configuration.rb:76:14: C: [Corrected] Security/YAMLLoad: Prefer using YAML.safe_load over YAML.load.
        YAML.load(ERB.new(File.read(file)).result) || {}
             ^^^^

@bundlerbot
Copy link
Contributor

💔 Test failed - status-travis

@matthewalbani matthewalbani force-pushed the update-rubocop branch 11 times, most recently from 2526786 to 254a561 Compare January 18, 2018 19:49
@@ -19,9 +19,9 @@
TrueClass :prerelease, :null => false
DateTime :created_at, :null => false
DateTime :updated_at, :null => false
index [:rubygem_id, :number, :platform], :unique => true
index %i[rubygem_id number platform], :unique => true
Copy link
Member

@olleolleolle olleolleolle Jan 19, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Introducing this syntax places our compatibility clearly in Ruby 2.

Another PR should update the gemspec with a required_ruby_version = '> 2.0' marker.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

did not think about that is there a desire to avoid requiring 2+ still?

@@ -13,7 +13,7 @@ def write_thread(resource_id, content = "unchanging", &block)
resource = storage.resource(resource_id.to_s)

if block
block.call(resource)
yield(resource)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You could try replacing if block with if block_given? (and remove the argument , &block)

@@ -31,7 +31,7 @@ def read_thread(resource_id, &block)

if resource.exist?(:file)
if block
block.call(resource)
yield(resource)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One more block_given? opportunity.

50.times do
# so travis doesnt timeout from no output
print "." if ((count += 1) % 5).zero?
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is so great. Thank you!

@bronzdoc
Copy link
Member

@bundlerbot r+

@bundlerbot
Copy link
Contributor

📌 Commit d6cd183 has been approved by bronzdoc

@bundlerbot
Copy link
Contributor

⌛ Testing commit d6cd183 with merge 8409634...

bundlerbot added a commit that referenced this pull request Mar 31, 2018
@bundlerbot
Copy link
Contributor

💔 Test failed - status-travis

@bundlerbot
Copy link
Contributor

☔ The latest upstream changes (presumably #178) made this pull request unmergeable. Please resolve the merge conflicts.

@bronzdoc
Copy link
Member

@matthewalbani i think this just needs a rebase to land :)

autofix Style/PercentLiteralDelimiters
add MarshalLoad, BlockLenth, LineLength to disabled list

set variable number to snake_case
add DuplicateGem and GlovalVar exeptions for spec tests

autofix the rest that rubocop would do
Manually fix the remaning issues
…t seems to make things worse

add a bit of output to "with large data" test so travis does not timeout
allow jruby to wait longer before timing out
@matthewalbani
Copy link
Contributor Author

@bronzdoc am i meant to do anything else after the rebase? the tests passed now, but the bot didnt do anything.

@bronzdoc
Copy link
Member

bronzdoc commented May 8, 2018

Thanks @matthewalbani!
@bundlerbot r+

@bundlerbot
Copy link
Contributor

📌 Commit 6d9e712 has been approved by bronzdoc

@bundlerbot
Copy link
Contributor

⌛ Testing commit 6d9e712 with merge 9bf9266...

bundlerbot added a commit that referenced this pull request May 8, 2018
@bundlerbot
Copy link
Contributor

☀️ Test successful - status-travis
Approved by: bronzdoc
Pushing 9bf9266 to master...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants