rules:
- id: ruby-eval
  message: >-
    Use of eval detected. This can run arbitrary code. Ensure external data
    does not reach here, otherwise this is a security vulnerability.
    Consider other ways to do this without eval.
  languages: [ruby]
  severity: WARNING
  pattern-either:
  - pattern: eval(...)
  - pattern: $BIND.eval(...)
  - pattern: |
      $CLASS.class_eval do
        ...
      end
  - pattern: |
      $CLASS.instance_eval do
        ...
      end
  - pattern: |
      $CLASS.module_eval do
        ...
      end
  - pattern: |
      $CLASS.class_eval(...)
  - pattern: |
      $CLASS.instance_eval(...)
  - pattern: |
      $CLASS.module_eval(...)
  - pattern: |
      $VM.compile(...).eval
  - patterns:
    - pattern: |
        $IS.eval
    - pattern-inside: |
        $IS = $VM.compile(...)
        ...
  metadata:
    category: security
    technology:
    - ruby