cookstyle-ng 8.0.0

data/lib/rubocop/cop/chef/correctness/node_normal_unless.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+#
+# Copyright:: Copyright 2019, Chef Software Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Correctness
+        # Normal attributes are discouraged since their semantics differ importantly from the default and override levels. Their values persist in the node object even after all code referencing them has been deleted, unlike default and override.
+        #
+        # Code should be updated to use default or override levels, but this will change attribute merging behavior so needs to be validated manually and force_default or force_override levels may need to be used in recipe code.
+        #
+        # @example
+        #
+        #   ### incorrect
+        #   node.normal_unless['foo'] = true
+        #
+        #   ### correct
+        #   node.default_unless['foo'] = true
+        #   node.override_unless['foo'] = true
+        #   node.force_default_unless['foo'] = true
+        #   node.force_override_unless['foo'] = true
+        #
+        class NodeNormalUnless < Base
+          MSG = 'Do not use node.normal_unless. Replace with default/override/force_default/force_override attribute levels.'
+          RESTRICT_ON_SEND = [:normal_unless].freeze
+
+          def_node_matcher :node_normal_unless?, <<-PATTERN
+            (send (send _ :node) :normal_unless)
+          PATTERN
+
+          def on_send(node)
+            node_normal_unless?(node) do
+              add_offense(node, severity: :refactor)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/correctness/node_save.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+#
+# Copyright:: Copyright 2019, Chef Software Inc.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Correctness
+        # Don't use node.save to save partial node data to the Chef Infra Server mid-run unless it's a requirement of cookbook design that can't be avoided. Node.save can result in failed Chef Infra runs appearing in search and increases load on the Chef Infra Server."
+        #
+        # @example
+        #
+        #   ### incorrect
+        #   node.save
+        #
+        class CookbookUsesNodeSave < Base
+          MSG = "Don't use node.save to save partial node data to the Chef Infra Server mid-run unless it's absolutely necessary. Node.save can result in failed Chef Infra runs appearing in search and increases load on the Chef Infra Server."
+          RESTRICT_ON_SEND = [:save].freeze
+
+          def_node_matcher :node_save?, <<-PATTERN
+            (send (send nil? :node) :save)
+          PATTERN
+
+          def on_send(node)
+            node_save?(node) do
+              add_offense(node, severity: :refactor)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/correctness/notifies_action_not_symbol.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+#
+# Copyright:: 2019, Chef Software Inc.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Correctness
+        # When notifying or subscribing actions within a resource the action should always be a symbol. In Chef Infra Client releases before 14.0, this may result in double notification.
+        #
+        # @example
+        #
+        #   ### incorrect
+        #   execute 'some command' do
+        #     notifies 'restart', 'service[httpd]', 'delayed'
+        #   end
+        #
+        #   execute 'some command' do
+        #     subscribes 'restart', 'service[httpd]', 'delayed'
+        #   end
+        #
+        #   ### correct
+        #   execute 'some command' do
+        #     notifies :restart, 'service[httpd]', 'delayed'
+        #   end
+        #
+        #   execute 'some command' do
+        #     subscribes :restart, 'service[httpd]', 'delayed'
+        #   end
+        #
+        class NotifiesActionNotSymbol < Base
+          include RuboCop::Chef::CookbookHelpers
+          extend AutoCorrector
+
+          MSG = 'Resource notification and subscription actions should be symbols not strings.'
+
+          def on_block(node)
+            match_property_in_resource?(nil, %w(notifies subscribes), node) do |notifies_property|
+              return unless notifies_property.node_parts[2].str_type?
+
+              add_offense(notifies_property, severity: :refactor) do |corrector|
+                corrector.replace(notifies_property.first_argument,
+                  ":#{notifies_property.node_parts[2].value}")
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/correctness/octal_mode_as_string.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+#
+# Copyright:: Copyright 2020, Chef Software Inc.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Correctness
+        # Don't represent file modes as Strings containing octal values.
+        #
+        # @example
+        #
+        #   ### incorrect
+        #   file '/etc/some_file' do
+        #     mode '0o755'
+        #   end
+        #
+        #   ### correct
+        #   file '/etc/some_file' do
+        #     mode '0755'
+        #   end
+        #
+        class OctalModeAsString < Base
+          MSG = "Don't represent file modes as strings containing octal values. Use standard base 10 file modes instead. For example: '0755'."
+          RESTRICT_ON_SEND = [:mode].freeze
+
+          def on_send(node)
+            return unless node.arguments.first&.str_type? && node.arguments.first.value.match?(/^0o/)
+            add_offense(node, severity: :refactor)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/correctness/openssl_password_helpers.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+#
+# Copyright:: Copyright 2020, Chef Software Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Correctness
+        # The OpenSSL cookbook provides a deprecated `secure_password` helper in the `Opscode::OpenSSL::Password` class, which should no longer be used. This helper would generate a random password that would be used when a data bag or attribute was no present. The practice of generating passwords to be stored on the node is bad security as it exposes the password to anyone that can view the nodes, and deleting a node deletes the password. Passwords should be retrieved from a secure source for use in cookbooks.
+        #
+        #   ### incorrect
+        #   ::Chef::Recipe.send(:include, Opscode::OpenSSL::Password)
+        #   basic_auth_password = secure_password
+        #
+        class OpenSSLPasswordHelpers < Base
+          MSG = 'The `secure_password` helper from the openssl cookbooks `Opscode::OpenSSL::Password` class should not be used to generate passwords.'
+
+          def_node_matcher :openssl_helper?, <<~PATTERN
+            (const
+              (const
+                (const nil? :Opscode) :OpenSSL) :Password)
+          PATTERN
+
+          def on_const(node)
+            openssl_helper?(node) do
+              add_offense(node, severity: :warning)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/correctness/powershell_delete_file.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+#
+# Copyright:: 2020, Chef Software, Inc.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Correctness
+        # Use the `file` or `directory` resources built into Chef Infra Client with the :delete action to remove files/directories instead of using Remove-Item in a powershell_script resource
+        #
+        # @example
+        #
+        #   ### incorrect
+        #   powershell_script 'Cleanup old files' do
+        #     code 'Remove-Item C:\Windows\foo\bar.txt'
+        #     only_if { ::File.exist?('C:\\Windows\\foo\\bar.txt') }
+        #   end
+        #
+        #  ### correct
+        #  file 'C:\Windows\foo\bar.txt' do
+        #    action :delete
+        #  end
+        #
+        class PowershellScriptDeleteFile < Base
+          include RuboCop::Chef::CookbookHelpers
+
+          MSG = 'Use the `file` or `directory` resources built into Chef Infra Client with the :delete action to remove files/directories instead of using Remove-Item in a powershell_script resource'
+
+          def on_block(node)
+            match_property_in_resource?(:powershell_script, 'code', node) do |code_property|
+              property_data = method_arg_ast_to_string(code_property)
+              return unless property_data && property_data.match?(/^remove-item/i) &&
+                            !property_data.include?('*')
+              add_offense(node, severity: :refactor)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/correctness/powershell_file_exists.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+#
+# Copyright:: 2021, Chef Software, Inc.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Correctness
+        # Use Ruby's built-in `File.exist?('C:\somefile')` method instead of executing PowerShell's `Test-Path` cmdlet, which takes longer to load.
+        #
+        # @example
+        #
+        #  ### incorrect
+        #  powershell_out('Test-Path "C:\\Program Files\\LAPS\\CSE\\AdmPwd.dll"').stdout.strip == 'True'
+        #
+        #  ### correct
+        #  ::File.exist?('C:\Program Files\LAPS\CSE\AdmPwd.dll')
+        #
+        class PowershellFileExists < Base
+          RESTRICT_ON_SEND = [:powershell_out, :powershell_out!].freeze
+          MSG = "Use Ruby's built-in `File.exist?('C:\\somefile')` method instead of executing PowerShell's `Test-Path` cmdlet, which takes longer to load."
+
+          def_node_matcher :powershell_out_exists?, <<-PATTERN
+            (send nil? {:powershell_out :powershell_out!} (str $_))
+          PATTERN
+
+          def on_send(node)
+            powershell_out_exists?(node) do |exists_string|
+              return unless exists_string.match?(/^Test-Path/)
+              add_offense(node, severity: :refactor)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/correctness/property_without_type.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+#
+# Copyright:: Copyright 2020, Chef Software Inc.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Correctness
+        # Resource properties or attributes should always define a type to help users understand the correct allowed values.
+        #
+        # @example
+        #
+        #   ### incorrect
+        #   property :size, regex: /^\d+[KMGTP]$/
+        #   attribute :size, regex: /^\d+[KMGTP]$/
+        #
+        #   ### correct
+        #   property :size, String, regex: /^\d+[KMGTP]$/
+        #   attribute :size, kind_of: String, regex: /^\d+[KMGTP]$/
+        #
+        class PropertyWithoutType < Base
+          MSG = 'Resource properties or attributes should always define a type to help users understand the correct allowed values.'
+          RESTRICT_ON_SEND = [:property, :attribute].freeze
+
+          def_node_matcher :property_without_type?, <<-PATTERN
+          (send nil? {:property :attribute}
+            (sym _)
+            $(hash
+
+              ...
+            )?
+          )
+          PATTERN
+
+          def on_send(node)
+            property_without_type?(node) do |hash_vals|
+              return if hash_vals&.first&.keys&.include?(s(:sym, :kind_of))
+
+              add_offense(node, severity: :refactor)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/correctness/resource_sets_internal_properties.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+#
+# Copyright:: Copyright 2019, Chef Software Inc.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Correctness
+        # Chef Infra Client uses properties in several resources to track state. These should not be set in recipes as they break the internal workings of the Chef Infra Client
+        #
+        # @example
+        #
+        #   ### incorrect
+        #   service 'foo' do
+        #     running true
+        #     action [:start, :enable]
+        #   end
+        #
+        #   ### correct
+        #   service 'foo' do
+        #     action [:start, :enable]
+        #   end
+        #
+        class ResourceSetsInternalProperties < Base
+          include RuboCop::Chef::CookbookHelpers
+
+          MSG = 'Do not set properties used internally by Chef Infra Client to track the system state.'
+
+          def on_block(node)
+            match_property_in_resource?(:service, 'running', node) do |prop|
+              add_offense(prop, severity: :refactor)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/correctness/resource_sets_name_property.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+#
+# Copyright:: 2019, Chef Software Inc.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Correctness
+        # Use name properties instead of setting the name property in a resource. Setting the name property directly causes notification and reporting issues.
+        #
+        # @example
+        #
+        #   ### incorrect
+        #   service 'foo' do
+        #    name 'bar'
+        #   end
+        #
+        #   ### correct
+        #   service 'foo' do
+        #    service_name 'bar'
+        #   end
+        #
+        class ResourceSetsNameProperty < Base
+          include RuboCop::Chef::CookbookHelpers
+
+          MSG = 'Resource sets the name property in the resource instead of using a name_property.'
+
+          def on_block(node)
+            match_property_in_resource?(nil, 'name', node) do |name_node|
+              add_offense(name_node, severity: :refactor)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/correctness/resource_with_none_action.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+#
+# Copyright:: 2019, Chef Software Inc.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Correctness
+        # The :nothing action is often typo'd as :none
+        #
+        # @example
+        #
+        #   ### incorrect
+        #   service 'foo' do
+        #    action :none
+        #   end
+        #
+        #   ### correct
+        #   service 'foo' do
+        #    action :nothing
+        #   end
+        #
+        class ResourceWithNoneAction < Base
+          include RuboCop::Chef::CookbookHelpers
+          extend AutoCorrector
+
+          MSG = 'Resource uses the nonexistent :none action instead of the :nothing action'
+
+          def on_block(node)
+            match_property_in_resource?(nil, 'action', node) do |action_node|
+              action_node.arguments.each do |action|
+                next unless action.source == ':none'
+                add_offense(action, severity: :refactor) do |corrector|
+                  corrector.replace(action, ':nothing')
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/correctness/scoped_file_exist.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+#
+# Copyright:: Copyright 2019, Chef Software Inc.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Correctness
+        # Scope file exist to access the correct `File` class by using `::File.exist?` not `File.exist?`.
+        #
+        # @example
+        #
+        #   ### incorrect
+        #   not_if { File.exist?('/etc/foo/bar') }
+        #
+        #   ### correct
+        #   not_if { ::File.exist?('/etc/foo/bar') }
+        #
+        class ScopedFileExist < Base
+          extend AutoCorrector
+
+          MSG = 'Scope file exist to access the correct File class by using ::File.exist? not File.exist?.'
+
+          def_node_matcher :unscoped_file_exist?, <<-PATTERN
+          (block (send nil? {:not_if :only_if}) (args) (send $(const nil? :File) {:exist? :exists?} (...)))
+          PATTERN
+
+          def on_block(node)
+            unscoped_file_exist?(node) do |m|
+              add_offense(m, severity: :refactor) do |corrector|
+                corrector.replace(m, '::File')
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end