From 3aa9fa8adf920bbcf7c621e161575b78ae9fd29e Mon Sep 17 00:00:00 2001
From: John Hawthorn <john@hawthorn.email>
Date: Thu, 22 Jun 2023 14:50:52 -0700
Subject: [PATCH] Improve check for hash literals

Previously this linter was possible to circumvent by using splats.
---
 lib/rubocop/cop/github/render_literal_helpers.rb |  3 ++-
 test/test_rails_controller_render_literal.rb     | 11 +++++++++++
 test/test_rails_view_render_literal.rb           | 16 ++++++++++++++++
 3 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/lib/rubocop/cop/github/render_literal_helpers.rb b/lib/rubocop/cop/github/render_literal_helpers.rb
index 67417a54..29820b0e 100644
--- a/lib/rubocop/cop/github/render_literal_helpers.rb
+++ b/lib/rubocop/cop/github/render_literal_helpers.rb
@@ -41,7 +41,8 @@ module RenderLiteralHelpers
         PATTERN
 
         def hash_with_literal_keys?(hash)
-          hash.pairs.all? { |pair| literal?(pair.key) }
+          hash.children.all? { |child| child.pair_type? } &&
+            hash.pairs.all? { |pair| literal?(pair.key) }
         end
 
         def render_view_component?(node)
diff --git a/test/test_rails_controller_render_literal.rb b/test/test_rails_controller_render_literal.rb
index 9da2f16c..d8ebfba0 100644
--- a/test/test_rails_controller_render_literal.rb
+++ b/test/test_rails_controller_render_literal.rb
@@ -442,6 +442,17 @@ def index
     assert_equal 1, offenses.count
   end
 
+  def test_render_literal_splat_locals_offense
+    offenses = investigate cop, <<-RUBY, "app/controllers/products_controller.rb"
+      class ProductsController < ActionController::Base
+        def index
+          render "products/product", locals: { **locals }
+        end
+      end
+    RUBY
+
+    assert_equal 1, offenses.count
+  end
 
   def test_render_literal_dynamic_local_key_offense
     offenses = investigate cop, <<-RUBY, "app/controllers/products_controller.rb"
diff --git a/test/test_rails_view_render_literal.rb b/test/test_rails_view_render_literal.rb
index b983d5f8..c2ba57e0 100644
--- a/test/test_rails_view_render_literal.rb
+++ b/test/test_rails_view_render_literal.rb
@@ -145,6 +145,14 @@ def test_render_literal_dynamic_local_key_offense
     assert_equal 1, offenses.count
   end
 
+  def test_render_literal_splat_locals_offense
+    offenses = erb_investigate cop, <<-ERB, "app/views/products/index.html.erb"
+      <%= render "products/product", { **locals } %>
+    ERB
+
+    assert_equal 1, offenses.count
+  end
+
   def test_render_options_static_locals_no_offense
     offenses = erb_investigate cop, <<-ERB, "app/views/products/index.html.erb"
       <%= render partial: "products/product", locals: { product: product } %>
@@ -168,4 +176,12 @@ def test_render_options_dynamic_local_key_offense
 
     assert_equal 1, offenses.count
   end
+
+  def test_render_options_local_splat_offense
+    offenses = erb_investigate cop, <<-ERB, "app/views/products/index.html.erb"
+      <%= render partial: "products/product", locals: { **locals } %>
+    ERB
+
+    assert_equal 1, offenses.count
+  end
 end