add rubocop security test on emitted code

Rakefile

@@ -12,6 +12,9 @@ Hoe.spec 'rexical' do
   self.history_file = 'CHANGELOG.rdoc'
   developer('Aaron Patterson', 'aaronp@rubyforge.org')
   self.extra_rdoc_files = FileList['*.rdoc']
+  self.extra_dev_deps += [
+    ["rubocop", "~> 0.74.0"]
+  ]
 end
 
 namespace :gem do

test/test_generator.rb

@@ -3,6 +3,7 @@
 require 'tempfile'
 require 'rexical'
 require 'stringio'
+require 'open3'
 
 class TestGenerator < Minitest::Test
   def test_header_is_written_after_module
@@ -26,6 +27,29 @@ def test_header_is_written_after_module
     assert_equal '#++', comments.last
   end
 
+  def test_rubocop_security
+    rex = Rexical::Generator.new(
+      "--independent" => true
+    )
+    rex.grammar_file = File.join File.dirname(__FILE__), 'assets', 'test.rex'
+    rex.read_grammar
+    rex.parse
+
+    output = Tempfile.new(["rex_output", ".rb"])
+    begin
+      rex.write_scanner output
+      output.close
+
+      stdin, stdoe, wait_thr = Open3.popen2e "rubocop --only Security #{output.path}"
+      if ! wait_thr.value.success?
+        fail stdoe.read
+      end
+    ensure
+      output.close
+      output.unlink
+    end
+  end
+
   def test_read_non_existent_file
     rex = Rexical::Generator.new(nil)
     rex.grammar_file = 'non_existent_file'