# frozen_string_literal: true

module RuboCop
  module Cop
    module Security
      # This cop checks for the use of YAML class methods which have
      # potential security issues leading to remote code execution when
      # loading from an untrusted source.
      #
      # @example
      #   # bad
      #   YAML.load("--- foo")
      #
      #   # good
      #   YAML.safe_load("--- foo")
      #   YAML.dump("foo")
      #
      class YAMLLoad < Cop
        MSG = 'Prefer using `YAML.safe_load` over `YAML.load`.'.freeze

        def_node_matcher :yaml_load, <<-END
          (send (const nil :YAML) :load ...)
        END

        def on_send(node)
          yaml_load(node) do |method|
            add_offense(node, :selector, format(MSG, method))
          end
        end

        def autocorrect(node)
          ->(corrector) { corrector.replace(node.loc.selector, 'safe_load') }
        end
      end
    end
  end
end

# frozen_string_literal: true

module RuboCop
  module Cop
    module Security
      # This cop checks for the use of YAML class methods which have
      # potential security issues leading to remote code execution when
      # loading from an untrusted source.
      #
      # @example
      #   # bad
      #   YAML.load("--- foo")
      #
      #   # good
      #   YAML.safe_load("--- foo")
      #   YAML.dump("foo")
      #
      class YAMLLoad < Cop
        MSG = 'Prefer using `YAML.safe_load` over `YAML.load`.'.freeze

        def_node_matcher :yaml_load, <<-END
          (send (const nil :YAML) :load ...)
        END

        def on_send(node)
          yaml_load(node) do
            add_offense(node, :selector)
          end
        end

        def autocorrect(node)
          ->(corrector) { corrector.replace(node.loc.selector, 'safe_load') }
        end
      end
    end
  end
end

Remove unused argument for `format` in `Security/YAMLLoad` cop
Remove unused argument for `format` in `Security/YAMLLoad` cop

With `ruby -w`, a warning is occurred in `Security/YAMLLoad` cop.

```sh
$ RUBYOPT=-w
/home/pocke/.gem/ruby/2.4.0/gems/parser-2.3.3.1/lib/parser/lexer.rb:10922: warning: assigned but unused variable - testEof
/home/pocke/.gem/ruby/2.4.0/gems/rubocop-0.47.1/lib/rubocop/magic_comment.rb:124: warning: `frozen_string_literal' is ignored after any tokens
Inspecting 888 files
............................/home/pocke/.gem/ruby/2.4.0/gems/rubocop-0.47.1/lib/rubocop/cop/security/yaml_load.rb:27: warning: too many arguments for format string
........................................................................................................................................................................................................................................................................................................................................................................................................................................................./home/pocke/.gem/ruby/2.4.0/gems/rubocop-0.47.1/lib/rubocop/cop/security/yaml_load.rb:27: warning: too many arguments for format string
...................................................................................................................................................................................................................................................................................................................................................................................................................................

888 files inspected, no offenses detected
```

The argument is not used. So, I've remove it.

Note
-----

Other warnings are occurred, however, this change ignores the warnings.

- `/home/pocke/.gem/ruby/2.4.0/gems/parser-2.3.3.1/lib/parser/lexer.rb:10922: warning: assigned but unused variable - testEof`
  - It's a parser gem's problem.
- `/home/pocke/.gem/ruby/2.4.0/gems/rubocop-0.47.1/lib/rubocop/magic_comment.rb:124: warning: `frozen_string_literal' is ignored after any tokens`
  - It's a false positive.
