One Easy Way to Improve Your Ruby Security
Tags: ruby, security, rails
Published: 2019-01-06 18:50:33

---
title: One Easy Way to Improve Your Ruby Security
published: true
description: How to use Rubocop to help you write more secure Ruby and Rails code. 
tags: ruby, security, rails
cover_image: https://thepracticaldev.s3.amazonaws.com/i/vbiwgdr373gpcd60unj2.png
---

Many people in the Ruby community have heard of [Rubocop](https://rubocop.readthedocs.io/en/latest/), and likely have some sort of love/hate relationship with it. If you haven't heard of this often polarizing gem, here is the gist of what it does straight from the Rubocop docs.

> RuboCop is a Ruby static code analyzer (a.k.a. linter) and code formatter. Out of the box it will enforce many of the guidelines outlined in the community [Ruby Style Guide.](https://github.com/rubocop-hq/ruby-style-guide)

However, Rubocop is **not** just for enforcing style guidelines. Did you know you can use Rubocop to enforce security best practices?! 

![](https://thepracticaldev.s3.amazonaws.com/i/kfkfmzi3qmfporoa7nsh.gif)

YEP! That's right! Rubocop has a built in set of [Security Cops](https://rubocop.readthedocs.io/en/latest/cops_security/) that can help you write more secure Ruby and Rails code. The cops are:

* [Security/Eval](https://rubocop.readthedocs.io/en/latest/cops_security/#securityeval)- The use of eval represents a serious security risk.
* [Security/JSONLoad](https://rubocop.readthedocs.io/en/latest/cops_security/#securityjsonload) - Prefer usage of `JSON.parse` over `JSON.load` due to potential security issues. See [ruby docs](https://ruby-doc.org/stdlib-2.3.0/libdoc/json/rdoc/JSON.html#method-i-load) for more information.
* [Security/MarshalLoad](https://rubocop.readthedocs.io/en/latest/cops_security/#securitymarshalload) - Avoid using of `Marshal.load` or `Marshal.restore` due to potential security issues. See [ruby docs](https://ruby-doc.org/core-2.3.3/Marshal.html#module-Marshal-label-Security+considerations) for more information.
* [Security/Open](https://rubocop.readthedocs.io/en/latest/cops_security/#securityopen) - The use of Kernel#open represents a serious security risk.
* [Security/YAMLLoad](https://rubocop.readthedocs.io/en/latest/cops_security/#securityyamlload) - Prefer usage of `YAML.safe_load` over `YAML.load` due to potential security issues. See [ruby docs](https://ruby-doc.org/stdlib-2.3.3/libdoc/yaml/rdoc/YAML.html#module-YAML-label-Security) for more information.

In addition to the security cops, there are also a couple of other cops that can improve your code security.
* [Rails/OutputSafety](https://rubocop.readthedocs.io/en/latest/cops_rails/#railsoutputsafety) - The use of `html_safe` or `raw` may be a security risk. Often using these can lead to a [cross site scripting](https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)) vulnerability. 
* [Style/MutableConstant](https://rubocop.readthedocs.io/en/latest/cops_style/#stylemutableconstant) - Do not assign mutable objects to constants. The security implications of this might be less obvious. For example, if you accidentally update a constant with say user data , and then that constant gets used for another user, suddenly you have a data leak. For this reason, it's best to ensure constants are always immutable.  

## How to Enable ONLY the Security Cops

If you want to use Rubocop just for the security cops, and not those pesky style cops 😉, here is how you would set it up. First, you need to [install the gem](https://rubocop.readthedocs.io/en/latest/installation/).

```ruby
gem install rubocop
```

Or if you are using a Gemfile...

```ruby
gem 'rubocop', require: false
```

Once the gem is installed you will want to configure it with a `rubocop.yml` file in your home directory. To just enable the security focused cops your yaml file should look like this 👇

```
AllCops:
  DisabledByDefault: true

Rails/OutputSafety:
  Enabled: true

Security:
  Enabled: true

Style/MutableConstant:
  Enabled: true
```

Then all you have to do is run it!  
```
$ rubocop
```

For more tips on basic usage checkout the [rubocop docs](https://rubocop.readthedocs.io/en/latest/basic_usage/). 

Happy Coding! 😃