inspec-core 4.38.3 → 4.38.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: da7b208efcb020501f9a283e5e512d3862cd4c3e7c19f2012e143af2721fd893
-  data.tar.gz: f534843ff5445086f3d40802fff3fe19c8ed787660dde2ce17816e8dc1225cac
+  metadata.gz: 17449ad4c9680511a8fc11c6fdb11d9ece550a7942c9e734c95eac0d41913d9f
+  data.tar.gz: ae5055ccc9bebd1aed4f22da4ad4dcd1be31e1bd2b5707e7b5fb088c916eda08
 SHA512:
-  metadata.gz: efd72de313d408802e8484dba99e6291bcd1a571fe028642736fccfcb3d02b78bb700d88a0441d6b2525285891707a738b8315c8dc315edc50e288eb000940e3
-  data.tar.gz: 12d51bdaea741376370ea5e64abf645d9734a2edf4328118b8931c11d6032446830f0f7f495eed987e7fcc27518472e21f523d93bd1c1578468b97d9028d11c3
+  metadata.gz: 6cec299ca48d7ca4c3fb9b3eecc79c8687541fbd83fc79e837ed13d2abb4bcb861f747782a68bf90f7e1083443a671079a1368a97e9f552e249e456616a92059
+  data.tar.gz: 287e2d79dbc494c83d6f8b8046e0f9c54632c5a13ec75ac69b603bdf9fe9b6a89ff86c9c8f025f7e04372490adb1ffa5a5a7fc10f3ecab1e7fabd70f71f6767d

data/Gemfile

@@ -20,22 +20,11 @@ end
 # but our runtime dep is still 3.9+
 gem "rspec", ">= 3.10"
 
-def probably_x86?
-  # We don't currently build on ARM windows, so assume x86 there
-  return true if RUBY_PLATFORM =~ /windows|mswin|msys|mingw|cygwin/
-
-  # Otherwise rely on uname -m
-  `uname -m`.match?(/^(x86_64|i\d86)/)
-end
-
 group :omnibus do
   gem "rb-readline"
   gem "appbundler"
   gem "ed25519" # ed25519 ssh key support done here as its a native gem we can't put in the gemspec
   gem "bcrypt_pbkdf" # ed25519 ssh key support done here as its a native gem we can't put in the gemspec
-  if probably_x86?
-    gem "x25519" # ed25519 KEX module, not supported on ARM
-  end
 end
 
 group :test do

data/lib/inspec/resources/mssql_session.rb

@@ -42,11 +42,7 @@ module Inspec::Resources
       @local_mode = opts[:local_mode]
       unless local_mode?
         @host = opts[:host] || "localhost"
-        if opts.key?(:port)
-          @port = opts[:port]
-        else
-          @port = "1433"
-        end
+        @port = opts[:port]
       end
       @instance = opts[:instance]
       @db_name = opts[:db_name]

data/lib/inspec/resources/oracledb_session.rb

@@ -38,11 +38,12 @@ module Inspec::Resources
       @sqlcl_bin = opts[:sqlcl_bin] || nil
       @sqlplus_bin = opts[:sqlplus_bin] || "sqlplus"
       skip_resource "Option 'as_os_user' not available in Windows" if inspec.os.windows? && su_user
-      fail_resource "Can't run Oracle checks without authentication" unless su_user && (user || password)
-      fail_resource "You must provide a service name for the session" unless service
+      fail_resource "Can't run Oracle checks without authentication" unless su_user || (user || password)
     end
 
     def query(sql)
+      raise Inspec::Exceptions::ResourceFailed, "#{resource_exception_message}" if resource_failed?
+
       if @sqlcl_bin && inspec.command(@sqlcl_bin).exist?
         @bin = @sqlcl_bin
         format_options = "set sqlformat csv\nSET FEEDBACK OFF"
@@ -53,8 +54,17 @@ module Inspec::Resources
 
       command = command_builder(format_options, sql)
       inspec_cmd = inspec.command(command)
+      out = inspec_cmd.stdout + "\n" + inspec_cmd.stderr
 
-      DatabaseHelper::SQLQueryResult.new(inspec_cmd, parse_csv_result(inspec_cmd.stdout))
+      if inspec_cmd.exit_status != 0 || !inspec_cmd.stderr.empty? || out.downcase =~ /^error.*/
+        raise Inspec::Exceptions::ResourceFailed, "Oracle query with errors: #{out}"
+      else
+        begin
+          DatabaseHelper::SQLQueryResult.new(inspec_cmd, parse_csv_result(inspec_cmd.stdout))
+        rescue
+          raise Inspec::Exceptions::ResourceFailed, "Oracle query with errors: #{out}"
+        end
+      end
     end
 
     def to_s
@@ -77,11 +87,11 @@ module Inspec::Resources
       end
 
       if @db_role.nil?
-        %{#{sql_prefix}#{bin} "#{user}"/"#{password}"@#{host}:#{port}/#{@service}#{sql_postfix}}
+        "#{sql_prefix}#{bin} #{user}/#{password}@#{host}:#{port}/#{@service}#{sql_postfix}"
       elsif @su_user.nil?
-        %{#{sql_prefix}#{bin} "#{user}"/"#{password}"@#{host}:#{port}/#{@service} as #{@db_role}#{sql_postfix}}
+        "#{sql_prefix}#{bin} #{user}/#{password}@#{host}:#{port}/#{@service} as #{@db_role}#{sql_postfix}"
       else
-        %{su - #{@su_user} -c "env ORACLE_SID=#{@service} #{@bin} / as #{@db_role}#{sql_postfix}"}
+        "su - #{@su_user} -c env ORACLE_SID=#{@service} #{@bin} / as #{@db_role}#{sql_postfix}"
       end
     end
 

data/lib/inspec/resources/postgres.rb

@@ -4,6 +4,8 @@ module Inspec::Resources
   class Postgres < Inspec.resource(1)
     name "postgres"
     supports platform: "unix"
+    supports platform: "windows"
+
     desc "The 'postgres' resource is a helper for the 'postgres_conf', 'postgres_hba_conf', 'postgres_ident_conf' & 'postgres_session' resources.  Please use those instead."
 
     attr_reader :service, :data_dir, :conf_dir, :conf_path, :version, :cluster
@@ -43,11 +45,17 @@ module Inspec::Resources
           @conf_dir = "/etc/postgresql/#{@version}/#{@cluster}"
           @data_dir = "/var/lib/postgresql/#{@version}/#{@cluster}"
         end
+      elsif inspec.os.windows?
+        dir = "C:\\Program Files\\PostgreSQL"
+        @version = version_from_psql || version_from_dir_windows(dir)
+        unless @version.to_s.empty?
+          @data_dir = "#{dir}\\#{@version}\\data\\"
+        end
       else
         @version = version_from_psql
         if @version.to_s.empty?
           if inspec.directory("/var/lib/pgsql/data").exist?
-            warn "Unable to determine PostgreSQL version: psql did not return" \
+            Inspec::Log.warn "Unable to determine PostgreSQL version: psql did not return" \
                  "a version number and unversioned data directories were found."
           else
             @version = version_from_dir("/var/lib/pgsql")
@@ -69,13 +77,13 @@ module Inspec::Resources
 
     def verify_dirs
       unless inspec.directory(@conf_dir).exist?
-        warn "Default postgresql configuration directory: #{@conf_dir} does not exist. " \
+        Inspec::Log.warn "Default postgresql configuration directory: #{@conf_dir} does not exist. " \
           "Postgresql may not be installed or we've misidentified the configuration " \
           "directory."
       end
 
       unless inspec.directory(@data_dir).exist?
-        warn "Default postgresql data directory: #{@data_dir} does not exist. " \
+        Inspec::Log.warn "Default postgresql data directory: #{@data_dir} does not exist. " \
           "Postgresql may not be installed or we've misidentified the data " \
           "directory."
       end
@@ -84,7 +92,15 @@ module Inspec::Resources
     def version_from_psql
       return unless inspec.command("psql").exist?
 
-      inspec.command("psql --version | awk '{ print $NF }' | awk -F. '{ print $1\".\"$2 }'").stdout.strip
+      version = inspec.command("psql --version").stdout.strip.split(" ")[2].split(".")
+
+      unless version.empty?
+        if version.first.to_i >= 10
+          version.first
+        else
+          "#{version[0]}.#{version[1]}"
+        end
+      end
     end
 
     def locate_data_dir_location_by_version(ver = @version)
@@ -100,7 +116,7 @@ module Inspec::Resources
       data_dir_loc = dir_list.detect { |i| inspec.directory(i).exist? }
 
       if data_dir_loc.nil?
-        warn 'Unable to find the PostgreSQL data_dir in expected location(s), please
+        Inspec::Log.warn 'Unable to find the PostgreSQL data_dir in expected location(s), please
         execute "psql -t -A -p <port> -h <host> -c "show hba_file";" as the PostgreSQL
         DBA to find the non-standard data_dir location.'
       end
@@ -112,15 +128,32 @@ module Inspec::Resources
       entries = dirs.lines.count
       case entries
       when 0
-        warn "Could not determine version of installed postgresql by inspecting #{dir}"
+        Inspec::Log.warn "Could not determine version of installed postgresql by inspecting #{dir}"
+        nil
+      when 1
+        Inspec::Log.warn "Using #{dirs}: #{dir_to_version(dirs)}"
+        dir_to_version(dirs)
+      else
+        Inspec::Log.warn "Multiple versions of postgresql installed or incorrect base dir #{dir}"
+        first = dir_to_version(dirs.lines.first)
+        Inspec::Log.warn "Using the first version found: #{first}"
+        first
+      end
+    end
+
+    def version_from_dir_windows(dir)
+      dirs = inspec.command("Get-ChildItem -Path \"#{dir}\" -Name").stdout
+      entries = dirs.lines.count
+      case entries
+      when 0
+        Inspec::Log.warn "Could not determine version of installed PostgreSQL by inspecting #{dir}"
         nil
       when 1
-        warn "Using #{dirs}: #{dir_to_version(dirs)}"
         dir_to_version(dirs)
       else
-        warn "Multiple versions of postgresql installed or incorrect base dir #{dir}"
+        Inspec::Log.warn "Multiple versions of PostgreSQL installed or incorrect base dir #{dir}"
         first = dir_to_version(dirs.lines.first)
-        warn "Using the first version found: #{first}"
+        Inspec::Log.warn "Using the first version found: #{first}"
         first
       end
     end
@@ -137,13 +170,13 @@ module Inspec::Resources
       else
         dirs = inspec.command("ls -d #{dir}/*/").stdout.lines
         if dirs.empty?
-          warn "No postgresql clusters configured or incorrect base dir #{dir}"
+          Inspec::Log.warn "No postgresql clusters configured or incorrect base dir #{dir}"
           return nil
         end
         first = dirs.first.chomp.split("/").last
         if dirs.count > 1
-          warn "Multiple postgresql clusters configured or incorrect base dir #{dir}"
-          warn "Using the first directory found: #{first}"
+          Inspec::Log.warn "Multiple postgresql clusters configured or incorrect base dir #{dir}"
+          Inspec::Log.warn "Using the first directory found: #{first}"
         end
         first
       end

data/lib/inspec/resources/postgres_conf.rb

@@ -22,6 +22,8 @@ module Inspec::Resources
     include FileReader
     include ObjectTraverser
 
+    attr_accessor :conf_path
+
     def initialize(conf_path = nil)
       @conf_path = conf_path || inspec.postgres.conf_path
       if @conf_path.nil?

data/lib/inspec/resources/postgres_hba_conf.rb

@@ -5,6 +5,7 @@ module Inspec::Resources
   class PostgresHbaConf < Inspec.resource(1)
     name "postgres_hba_conf"
     supports platform: "unix"
+    supports platform: "windows"
     desc 'Use the `postgres_hba_conf` InSpec audit resource to test the client
           authentication data defined in the pg_hba.conf file.'
     example <<~EXAMPLE
@@ -19,7 +20,7 @@ module Inspec::Resources
 
     # @todo add checks to ensure that we have data in our file
     def initialize(hba_conf_path = nil)
-      @conf_file = hba_conf_path || File.expand_path("pg_hba.conf", inspec.postgres.conf_dir)
+      @conf_file = hba_conf_path || File.join(inspec.postgres.conf_dir, "pg_hba.conf")
       @content = ""
       @params = {}
       read_content

data/lib/inspec/resources/postgres_ident_conf.rb

@@ -5,6 +5,7 @@ module Inspec::Resources
   class PostgresIdentConf < Inspec.resource(1)
     name "postgres_ident_conf"
     supports platform: "unix"
+    supports platform: "windows"
     desc 'Use the postgres_ident_conf InSpec audit resource to test the client
           authentication data is controlled by a pg_ident.conf file.'
     example <<~EXAMPLE
@@ -18,7 +19,7 @@ module Inspec::Resources
     attr_reader :params, :conf_file
 
     def initialize(ident_conf_path = nil)
-      @conf_file = ident_conf_path || File.expand_path("pg_ident.conf", inspec.postgres.conf_dir)
+      @conf_file = ident_conf_path || File.join(inspec.postgres.conf_dir, "pg_ident.conf")
       @content = nil
       @params = nil
       read_content

data/lib/inspec/resources/postgres_session.rb

@@ -12,7 +12,7 @@ module Inspec::Resources
     end
 
     def lines
-      output.split("\n")
+      output.split("\n").map(&:strip)
     end
 
     def to_s
@@ -54,7 +54,7 @@ module Inspec::Resources
       raise Inspec::Exceptions::ResourceFailed, "#{resource_exception_message}" if resource_failed?
 
       psql_cmd = create_psql_cmd(query, db)
-      cmd = inspec.command(psql_cmd, redact_regex: /(PGPASSWORD=').+(' psql .*)/)
+      cmd = inspec.command(psql_cmd, redact_regex: %r{(:\/\/[a-z]*:).*(@)})
       out = cmd.stdout + "\n" + cmd.stderr
       if cmd.exit_status != 0 || out =~ /could not connect to .*/ || out.downcase =~ /^error:.*/
         raise Inspec::Exceptions::ResourceFailed, "PostgreSQL query with errors: #{out}"
@@ -66,7 +66,7 @@ module Inspec::Resources
     private
 
     def test_connection
-      query("select now()")
+      query("select now()\;")
     end
 
     def escaped_query(query)
@@ -74,8 +74,12 @@ module Inspec::Resources
     end
 
     def create_psql_cmd(query, db = [])
-      dbs = db.map { |x| "-d #{x}" }.join(" ")
-      "PGPASSWORD='#{@pass}' psql -U #{@user} #{dbs} -h #{@host} -p #{@port} -A -t -c #{escaped_query(query)}"
+      dbs = db.map { |x| "#{x}" }.join(" ")
+      if inspec.os.windows?
+        "psql -d postgresql://#{@user}:#{@pass}@#{@host}:#{@port}/#{dbs} -A -t -w -c \"#{query}\""
+      else
+        "psql -d postgresql://#{@user}:#{@pass}@#{@host}:#{@port}/#{dbs} -A -t -w -c #{escaped_query(query)}"
+      end
     end
   end
 end

data/lib/inspec/rule.rb

@@ -360,7 +360,7 @@ module Inspec
         # A string that does not represent a valid time results in the date 0000-01-01.
         if [Date, Time].include?(expiry.class) || (expiry.is_a?(String) && Time.new(expiry).year != 0)
           expiry = expiry.to_time if expiry.is_a? Date
-          expiry = Time.new(expiry) if expiry.is_a? String
+          expiry = Time.parse(expiry) if expiry.is_a? String
           if expiry < Time.now # If the waiver expired, return - no skip applied
             __waiver_data["message"] = "Waiver expired on #{expiry}, evaluating control normally"
             return

data/lib/inspec/version.rb

@@ -1,3 +1,3 @@
 module Inspec
-  VERSION = "4.38.3".freeze
+  VERSION = "4.38.9".freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: inspec-core
 version: !ruby/object:Gem::Version
-  version: 4.38.3
+  version: 4.38.9
 platform: ruby
 authors:
 - Chef InSpec Team
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-06-23 00:00:00.000000000 Z
+date: 2021-07-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: chef-telemetry