Enable Security/JSONLoad

.rubocop.yml

@@ -944,6 +944,9 @@ Rails/TimeZone:
 Rails/Validation:
   Enabled: true
 
+Security/JSONLoad:
+  Enabled: true
+
 Style/AlignParameters:
   Enabled: false
 

.rubocop_todo.yml

@@ -38,18 +38,6 @@ RSpec/SingleArgumentMessageChain:
   Exclude:
     - 'spec/requests/api/internal_spec.rb'
 
-# Offense count: 8
-# Cop supports --auto-correct.
-# Configuration parameters: AutoCorrect.
-Security/JSONLoad:
-  Exclude:
-    - 'db/migrate/20161019190736_migrate_sidekiq_queues_from_default.rb'
-    - 'db/migrate/20161024042317_migrate_mailroom_queue_from_default.rb'
-    - 'db/migrate/20161124141322_migrate_process_commit_worker_jobs.rb'
-    - 'spec/migrations/migrate_process_commit_worker_jobs_spec.rb'
-    - 'spec/models/project_services/irker_service_spec.rb'
-    - 'spec/support/stub_gitlab_calls.rb'
-
 # Offense count: 55
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles.

db/migrate/20161019190736_migrate_sidekiq_queues_from_default.rb

@@ -93,7 +93,7 @@ def down
 
   def migrate_from_queue(redis, queue, job_mapping)
     while job = redis.lpop("queue:#{queue}")
-      payload = JSON.load(job)
+      payload = JSON.parse(job)
       new_queue = job_mapping[payload['class']]
 
       # If we have no target queue to migrate to we're probably dealing with

db/migrate/20161024042317_migrate_mailroom_queue_from_default.rb

@@ -47,7 +47,7 @@ def down
 
   def migrate_from_queue(redis, queue, job_mapping)
     while job = redis.lpop("queue:#{queue}")
-      payload = JSON.load(job)
+      payload = JSON.parse(job)
       new_queue = job_mapping[payload['class']]
 
       # If we have no target queue to migrate to we're probably dealing with

db/migrate/20161124141322_migrate_process_commit_worker_jobs.rb

@@ -34,7 +34,7 @@ def up
       new_jobs = []
 
       while job = redis.lpop('queue:process_commit')
-        payload = JSON.load(job)
+        payload = JSON.parse(job)
         project = Project.find_including_path(payload['args'][0])
 
         next unless project
@@ -75,7 +75,7 @@ def down
       new_jobs = []
 
       while job = redis.lpop('queue:process_commit')
-        payload = JSON.load(job)
+        payload = JSON.parse(job)
 
         payload['args'][2] = payload['args'][2]['id']
 

spec/migrations/migrate_process_commit_worker_jobs_spec.rb

@@ -62,7 +62,7 @@ def job_count
     end
 
     def pop_job
-      JSON.load(Sidekiq.redis { |r| r.lpop('queue:process_commit') })
+      JSON.parse(Sidekiq.redis { |r| r.lpop('queue:process_commit') })
     end
 
     before do
@@ -198,7 +198,7 @@ def job_count
       let(:job) do
         migration.down
 
-        JSON.load(Sidekiq.redis { |r| r.lpop('queue:process_commit') })
+        JSON.parse(Sidekiq.redis { |r| r.lpop('queue:process_commit') })
       end
 
       it 'includes the project ID' do

spec/models/project_services/irker_service_spec.rb

@@ -59,7 +59,7 @@
 
       conn = @irker_server.accept
       conn.readlines.each do |line|
-        msg = JSON.load(line.chomp("\n"))
+        msg = JSON.parse(line.chomp("\n"))
         expect(msg.keys).to match_array(['to', 'privmsg'])
         expect(msg['to']).to match_array(["irc://chat.freenode.net/#commits",
                                           "irc://test.net/#test"])

spec/support/stub_gitlab_calls.rb

@@ -35,7 +35,7 @@ def stub_container_registry_tags(*tags)
       { "tags" => tags }
     )
     allow_any_instance_of(ContainerRegistry::Client).to receive(:repository_manifest).and_return(
-      JSON.load(File.read(Rails.root + 'spec/fixtures/container_registry/tag_manifest.json'))
+      JSON.parse(File.read(Rails.root + 'spec/fixtures/container_registry/tag_manifest.json'))
     )
     allow_any_instance_of(ContainerRegistry::Client).to receive(:blob).and_return(
       File.read(Rails.root + 'spec/fixtures/container_registry/config_blob.json')