inspec 1.0.0 → 1.35.1

data/lib/matchers/matchers.rb

@@ -2,7 +2,6 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Dominik Richter
 # author: Christoph Hartmann
-# license: All rights reserved
 
 RSpec::Matchers.define :be_readable do
   match do |file|
@@ -70,7 +69,7 @@ end
 # matcher to check /etc/passwd, /etc/shadow and /etc/group
 RSpec::Matchers.define :contain_legacy_plus do
   match do |file|
-    warn '[DEPRECATION] `contain_legacy_plus` is deprecated and will be removed for InSpec 1.0. Please use `describe file(\'/etc/passwd\') do its(\'content\') { should_not match /^\+:/ } end`'
+    warn '[DEPRECATION] `contain_legacy_plus` is deprecated and will be removed in the next major version. Please use `describe file(\'/etc/passwd\') do its(\'content\') { should_not match /^\+:/ } end`'
     file.content =~ /^\+:/
   end
 end
@@ -78,7 +77,7 @@ end
 # verifies that no entry in an array contains a value
 RSpec::Matchers.define :contain_match do |regex|
   match do |arr|
-    warn '[DEPRECATION] `contain_match` is deprecated and will be removed for InSpec 1.0. See https://github.com/chef/inspec/issues/738 for more details'
+    warn '[DEPRECATION] `contain_match` is deprecated and will be removed in the next major version. See https://github.com/chef/inspec/issues/738 for more details'
     arr.inject { |result, i|
       result = i.match(regex)
       result || i.match(/$/)
@@ -88,7 +87,6 @@ end
 
 RSpec::Matchers.define :contain_duplicates do
   match do |arr|
-    warn '[DEPRECATION] `contain_duplicates` is deprecated and will be removed for InSpec 1.0. See https://github.com/chef/inspec/issues/738 for more details'
     dup = arr.select { |element| arr.count(element) > 1 }
     !dup.uniq.empty?
   end
@@ -105,7 +103,7 @@ RSpec::Matchers.define :be_installed do
   end
 
   chain :by do
-    fail "[UNSUPPORTED] Please use the new resources 'gem', 'npm' or 'pip'."
+    raise "[UNSUPPORTED] Please use the new resources 'gem', 'npm' or 'pip'."
   end
 
   chain :with_version do |version|
@@ -121,7 +119,7 @@ RSpec::Matchers.define :be_enabled do
   end
 
   chain :with_level do |_level|
-    fail '[UNSUPPORTED] with level is not supported'
+    raise '[UNSUPPORTED] with level is not supported'
   end
 
   failure_message do |service|
@@ -137,7 +135,7 @@ RSpec::Matchers.define :be_running do
   end
 
   chain :under do |_under|
-    fail '[UNSUPPORTED] under is not supported'
+    raise '[UNSUPPORTED] under is not supported'
   end
 
   failure_message do |service|
@@ -178,7 +176,7 @@ RSpec::Matchers.define :be_reachable do
   end
 
   chain :with do |_attr|
-    fail '[UNSUPPORTED] `with` is not supported in combination with `be_reachable`'
+    raise '[UNSUPPORTED] `with` is not supported in combination with `be_reachable`'
   end
 
   failure_message do |host|
@@ -193,7 +191,7 @@ RSpec::Matchers.define :be_resolvable do
   end
 
   chain :by do |_type|
-    fail "[UNSUPPORTED] `by` is not supported in combination with `be_resolvable`. Please use the following syntax `host('example.com', port: 53, proto: 'udp')`."
+    raise "[UNSUPPORTED] `by` is not supported in combination with `be_resolvable`. Please use the following syntax `host('example.com', port: 53, proto: 'udp')`."
   end
 
   failure_message do |host|
@@ -208,18 +206,57 @@ RSpec::Matchers.define :have_rule do |rule|
   end
 
   chain :with_table do |_table|
-    fail "[UNSUPPORTED] `with_table` is not supported in combination with `have_rule`. Please use the following syntax `iptables(table:'mangle', chain: 'input')`."
+    raise "[UNSUPPORTED] `with_table` is not supported in combination with `have_rule`. Please use the following syntax `iptables(table:'mangle', chain: 'input')`."
   end
 
   chain :with_chain do |_chain|
-    fail "[UNSUPPORTED] `with_table` is not supported in combination with `with_chain`. Please use the following syntax `iptables(table:'mangle', chain: 'input')`."
+    raise "[UNSUPPORTED] `with_table` is not supported in combination with `with_chain`. Please use the following syntax `iptables(table:'mangle', chain: 'input')`."
   end
 end
 
-# unsupported
-RSpec::Matchers.define :contain do |_rule|
-  match do |_resource|
-    fail "[UNSUPPORTED] `contain` matcher. Please use the following syntax `its('content') { should match('value') }`."
+# deprecated
+RSpec::Matchers.define :contain do |rule|
+  match do |resource|
+    warn "[DEPRECATION] `contain` matcher. Please use the following syntax `its('content') { should include('value') }`."
+    expect(resource).to include(rule)
+  end
+end
+
+# `be_in` matcher
+# You can use it in the following cases:
+# - check if an item or array is included in a given array
+# eg:
+# describe nginx do
+#   its('user') { should be_in AUTHORIZED_USER_LIST }
+# end
+# describe nginx do
+#   its('module_list') { should be_in AUTHORIZED_MODULE_LIST }
+# end
+RSpec::Matchers.define :be_in do |list|
+  match do |item|
+    # Handle both single item and array
+    item.is_a?(Array) ? (item - list).empty? : list.include?(item)
+  end
+
+  match_when_negated do |item|
+    # Handle both single item and array
+    item.is_a?(Array) ? (item & list).empty? : !list.include?(item)
+  end
+
+  failure_message do |item|
+    if item.is_a?(Array)
+      "expected `#{item}` to be in the list: `#{list}` \nDiff:\n #{(item - list)}"
+    else
+      "expected `#{item}` to be in the list: `#{list}`"
+    end
+  end
+
+  failure_message_when_negated do |item|
+    if item.is_a?(Array)
+      "expected `#{item}` not to be in the list: `#{list}` \nComm:\n #{(item & list)}"
+    else
+      "expected `#{item}` not to be in the list: `#{list}`"
+    end
   end
 end
 
@@ -251,6 +288,13 @@ RSpec::Matchers.define :cmp do |first_expected|
     %w{true false}.include?(value.downcase)
   end
 
+  def version?(value)
+    Gem::Version.new(value)
+    true
+  rescue ArgumentError => _ex
+    false
+  end
+
   # expects that the values have been checked with boolean?
   def to_boolean(value)
     value.casecmp('true') == 0
@@ -260,6 +304,8 @@ RSpec::Matchers.define :cmp do |first_expected|
     # if actual and expected are strings
     if expected.is_a?(String) && actual.is_a?(String)
       return actual.casecmp(expected) == 0 if op == :==
+      return Gem::Version.new(actual).method(op).call(Gem::Version.new(expected)) if
+        version?(expected) && version?(actual)
     elsif expected.is_a?(Regexp) && (actual.is_a?(String) || actual.is_a?(Integer))
       return !actual.to_s.match(expected).nil?
     elsif expected.is_a?(String) && integer?(expected) && actual.is_a?(Integer)
@@ -305,14 +351,18 @@ RSpec::Matchers.define :cmp do |first_expected|
   end
 
   failure_message do |actual|
-    actual = '0' + actual.to_s(8) if octal?(@expected)
+    actual = ('0' + actual.to_s(8)).inspect if octal?(@expected)
     "\n" + format_expectation(false) + "\n     got: #{actual}\n\n(compared using `cmp` matcher)\n"
   end
 
   failure_message_when_negated do |actual|
-    actual = '0' + actual.to_s(8) if octal?(@expected)
+    actual = ('0' + actual.to_s(8)).inspect if octal?(@expected)
     "\n" + format_expectation(true) + "\n     got: #{actual}\n\n(compared using `cmp` matcher)\n"
   end
+
+  description do
+    "cmp #{@operation} #{@expected.inspect}"
+  end
 end
 
 # user resource matcher for serverspec compatibility

data/lib/resources/aide_conf.rb

@@ -0,0 +1,162 @@
+# encoding: utf-8
+# author: Jen Burns, burnsjennifere@gmail.com
+
+require 'utils/filter'
+require 'utils/parser'
+
+# rubocop:disable Metrics/ClassLength
+module Inspec::Resources
+  class AideConf < Inspec.resource(1)
+    name 'aide_conf'
+    desc 'Use the aide_conf InSpec audit resource to test the rules established for
+      the file integrity tool AIDE. Controlled by the aide.conf file typically at /etc/aide.conf.'
+    example "
+      describe aide_conf do
+        its('selection_lines') { should include '/sbin' }
+      end
+
+      describe aide_conf.where { selection_line == '/bin' } do
+        its('rules.flatten') { should include 'r' }
+      end
+
+      describe aide_conf.all_have_rule('sha512') do
+        it { should eq true }
+      end
+    "
+
+    attr_reader :params
+
+    include CommentParser
+
+    def initialize(aide_conf_path = nil)
+      return skip_resource 'The `aide_conf` resource is not supported on your OS.' unless inspec.os.linux?
+      @conf_path = aide_conf_path || '/etc/aide.conf'
+      @content = nil
+      @rules = nil
+      read_content
+    end
+
+    def all_have_rule(rule)
+      # Case when file didn't exist or perms didn't allow an open
+      return false if @content.nil?
+
+      lines = @params.reject { |line| line['rules'].include? rule }
+      lines.empty?
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:selection_lines, field: 'selection_line')
+          .add(:rules,           field: 'rules')
+
+    filter.connect(self, :params)
+
+    private
+
+    def read_content
+      return @content unless @content.nil?
+      @rules = {}
+
+      file = inspec.file(@conf_path)
+      if !file.file?
+        return skip_resource "Can't find file \"#{@conf_path}\""
+      end
+      raw_conf = file.content
+      if raw_conf.nil?
+        return skip_resource "File can't be opened or is empty \"#{@conf_path}\""
+      end
+      if raw_conf.empty? && !file.empty?
+        return skip_resource "Can't read file \"#{@conf_path}\""
+      end
+
+      # If there is a file and it contains content, continue
+      @content = filter_comments(inspec.file(@conf_path).content.lines)
+      @params = parse_conf(@content)
+    end
+
+    def filter_comments(data)
+      content = []
+      data.each do |line|
+        content_line, = parse_comment_line(line, comment_char: '#', standalone_comments: false)
+        content.push(content_line)
+      end
+      content
+    end
+
+    def parse_conf(content)
+      params = []
+      content.each do |line|
+        param = parse_line(line)
+        if !param['selection_line'].nil?
+          params.push(param)
+        end
+      end
+      params
+    end
+
+    def parse_line(line)
+      line_and_rules = {}
+      # Case when line is a rule line
+      if line.include?(' = ')
+        parse_rule_line(line)
+      # Case when line is a selection line
+      elsif line.start_with?('/', '!', '=')
+        line_and_rules = parse_selection_line(line)
+      end
+      line_and_rules
+    end
+
+    def parse_rule_line(line)
+      line.gsub!(/\s+/, '')
+      rule_line_arr = line.split('=')
+      rules_list = rule_line_arr.last.split('+')
+      rule_name = rule_line_arr.first
+      rules_list.each_index do |i|
+        # Cases where rule respresents one or more other rules
+        if @rules.key?(rules_list[i])
+          rules_list[i] = @rules[rules_list[i]]
+        end
+        rules_list[i] = handle_multi_rule(rules_list, i)
+      end
+      @rules[rule_name] = rules_list.flatten
+    end
+
+    def parse_selection_line(line)
+      selec_line_arr = line.split(' ')
+      selection_line = selec_line_arr.first
+      selection_line.chop! if selection_line.end_with?('/')
+      rule_list = selec_line_arr.last.split('+')
+      rule_list.each_index do |i|
+        hash_list = @rules[rule_list[i]]
+        # Cases where rule respresents one or more other rules
+        if !hash_list.nil?
+          rule_list[i] = hash_list
+        end
+        rule_list[i] = handle_multi_rule(rule_list, i)
+      end
+      rule_list.flatten!
+      {
+        'selection_line' => selection_line,
+        'rules' => rule_list,
+      }
+    end
+
+    def handle_multi_rule(rule_list, i)
+      # Rules that represent multiple rules (R,L,>)
+      r_rules = %w{p i l n u g s m c md5}
+      l_rules = %w{p i l n u g}
+      grow_log_rules = %w{p l u g i n S}
+
+      case rule_list[i]
+      when 'R'
+        return r_rules
+      when 'L'
+        return l_rules
+      when '>'
+        return grow_log_rules
+      end
+      rule_list[i]
+    end
+  end
+end

data/lib/resources/apache.rb

@@ -2,7 +2,6 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Christoph Hartmann
 # author: Dominik Richter
-# license: All rights reserved
 
 module Inspec::Resources
   class Apache < Inspec.resource(1)

data/lib/resources/apache_conf.rb

@@ -2,7 +2,6 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Dominik Richter
 # author: Christoph Hartmann
-# license: All rights reserved
 
 require 'utils/simpleconfig'
 require 'utils/find_files'
@@ -70,7 +69,7 @@ module Inspec::Resources
       end
 
       raw_conf = file.content
-      if raw_conf.empty? && file.size > 0
+      if raw_conf.empty? && !file.empty?
         return skip_resource("Can't read file \"#{@conf_path}\"")
       end
 
@@ -82,7 +81,7 @@ module Inspec::Resources
         # parse include file parameters
         params = SimpleConfig.new(
           raw_conf,
-          assignment_re: /^\s*(\S+)\s+(.*)\s*$/,
+          assignment_regex: /^\s*(\S+)\s+(.*)\s*$/,
           multiple_values: true,
         ).params
         @params.merge!(params)
@@ -107,6 +106,7 @@ module Inspec::Resources
       (include_files + include_files_optional).each do |f|
         id    = Pathname.new(f).absolute? ? f : File.join(@conf_dir, f)
         files = find_files(id, depth: 1, type: 'file')
+        files += find_files(id, depth: 1, type: 'link')
 
         includes.push(files) if files
       end

data/lib/resources/apt.rb

@@ -89,7 +89,8 @@ module Inspec::Resources
         active = false if raw_line != line
 
         # eg.: deb http://archive.ubuntu.com/ubuntu/ wily main restricted
-        parse_repo = /^\s*(\S+)\s+"?([^ "\t\r\n\f]+)"?\s+(\S+)\s+(.*)$/.match(line)
+        # or : deb [trusted=yes] http://archive.ubuntu.com/ubuntu/ wily main restricted
+        parse_repo = /^\s*(\S+)\s+(?:\[\S+\])?\s*"?([^ "\t\r\n\f]+)"?\s+(\S+)\s+(.*)$/.match(line)
 
         # check if we got any result and the second param is an url
         next if parse_repo.nil? || !parse_repo[2] =~ HTTP_URL_RE

data/lib/resources/audit_policy.rb

@@ -2,7 +2,6 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Christoph Hartmann
 # author: Dominik Richter
-# license: All rights reserved
 
 # Advanced Auditing:
 # As soon as you start applying Advanced Audit Configuration Policy, legacy policies will be completely ignored.

data/lib/resources/auditd_conf.rb

@@ -2,7 +2,6 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Christoph Hartmann
 # author: Dominik Richter
-# license: All rights reserved
 
 require 'utils/simpleconfig'
 
@@ -41,7 +40,7 @@ module Inspec::Resources
       end
 
       content = file.content
-      if content.empty? && file.size > 0
+      if content.empty? && !file.empty?
         skip_resource "Can't read file '#{@conf_path}'"
         return @params = {}
       end

data/lib/resources/auditd_rules.rb

@@ -2,7 +2,6 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Christoph Hartmann
 # author: Dominik Richter
-# license: All rights reserved
 
 require 'forwardable'
 require 'utils/filter_array'
@@ -12,7 +11,7 @@ module Inspec::Resources
     def initialize(content)
       @content = content
       @opts = {
-        assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
         multiple_values: true,
       }
     end
@@ -27,7 +26,7 @@ module Inspec::Resources
 
     def status(name)
       @status_opts = {
-        assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
         multiple_values: false,
       }
       @status_content ||= inspec.command('/sbin/auditctl -s').stdout.chomp
@@ -86,6 +85,7 @@ module Inspec::Resources
         @legacy = AuditdRulesLegacy.new(@content)
       else
         parse_content
+        @legacy = nil
       end
     end
 
@@ -93,7 +93,7 @@ module Inspec::Resources
     # rubocop:disable Style/MethodName
     def LIST_RULES
       return @legacy.LIST_RULES if @legacy
-      fail 'Using legacy auditd_rules LIST_RULES interface with non-legacy audit package. Please use the new syntax.'
+      raise 'Using legacy auditd_rules LIST_RULES interface with non-legacy audit package. Please use the new syntax.'
     end
 
     def status(name = nil)
@@ -177,7 +177,7 @@ module Inspec::Resources
 
     # NB only in file lines
     def get_key(line)
-      line.match(/-k ([^ ]+)/)[1]
+      line.match(/-k ([^ ]+)/)[1] if line.include?('-k ')
     end
 
     # NOTE there are NO precautions wrt. filenames containing spaces in auditctl

data/lib/resources/bond.rb

@@ -28,7 +28,7 @@ module Inspec::Resources
       @content = @file.content
       @params = SimpleConfig.new(
         @file.content,
-        assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
         multiple_values: true,
       ).params if @file.exist?
       @loaded = true

data/lib/resources/bridge.rb

@@ -115,7 +115,7 @@ module Inspec::Resources
         adapter_collection.push(info) if info[:name].casecmp(bridge_name) == 0
       end
 
-      return nil if bridges.size == 0
+      return nil if bridges.empty?
       warn "[Possible Error] detected multiple bridges interfaces with the name #{bridge_name}" if bridges.size > 1
       bridges[0]
     end

data/lib/resources/command.rb

@@ -2,7 +2,6 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Dominik Richter
 # author: Christoph Hartmann
-# license: All rights reserved
 
 module Inspec::Resources
   class Cmd < Inspec.resource(1)
@@ -24,6 +23,9 @@ module Inspec::Resources
     attr_reader :command
 
     def initialize(cmd)
+      if cmd.nil?
+        raise 'InSpec `command` was called with `nil` as the argument. This is not supported. Please provide a valid command instead.'
+      end
       @command = cmd
     end
 
@@ -45,12 +47,12 @@ module Inspec::Resources
 
     def exist?
       # silent for mock resources
-      return false if inspec.os[:name].to_s == 'unknown'
+      return false if inspec.os.name.nil?
 
       if inspec.os.linux?
         res = inspec.backend.run_command("bash -c 'type \"#{@command}\"'")
       elsif inspec.os.windows?
-        res = inspec.backend.run_command("where.exe \"#{@command}\"")
+        res = inspec.backend.run_command("Get-Command \"#{@command}\"")
       elsif inspec.os.unix?
         res = inspec.backend.run_command("type \"#{@command}\"")
       else

data/lib/resources/crontab.rb

@@ -0,0 +1,102 @@
+# encoding: utf-8
+# author: Adam Leff
+
+require 'utils/parser'
+require 'utils/filter'
+
+module Inspec::Resources
+  class Crontab < Inspec.resource(1)
+    name 'crontab'
+    desc 'Use the crontab InSpec audit resource to test the contents of the crontab for a given user which contains information about scheduled tasks owned by that user.'
+    example "
+      describe crontab('root') do
+        its('commands') { should include '/path/to/some/script' }
+      end
+
+      describe crontab('myuser').commands('/home/myuser/build.sh') do
+        its('hours') { should cmp '*' }
+        its('minutes') { should cmp '*' }
+      end
+
+      describe crontab.where({'hour' => '*', 'minute' => '*'}) do
+        its('entries.length') { should cmp '0' }
+      end
+
+      describe crontab.where { command =~ /a partial command string/ } do
+        its('entries.length') { should cmp 1 }
+      end
+    "
+
+    attr_reader :params
+
+    include CommentParser
+
+    def initialize(user = nil)
+      @user   = user
+      @params = read_crontab
+
+      return skip_resource 'The `crontab` resource is not supported on your OS.' unless inspec.os.unix?
+    end
+
+    def read_crontab
+      inspec.command(crontab_cmd).stdout.lines.map { |l| parse_crontab_line(l) }.compact
+    end
+
+    def parse_crontab_line(l)
+      data, = parse_comment_line(l, comment_char: '#', standalone_comments: false)
+      return nil if data.nil? || data.empty?
+
+      case data
+      when /@hourly .*/
+        { 'minute' => '0', 'hour' => '*', 'day' => '*', 'month' => '*', 'weekday' => '*', 'command' => data.split(/\s+/, 2).at(1) }
+      when /@(midnight|daily) .*/
+        { 'minute' => '0', 'hour' => '0', 'day' => '*', 'month' => '*', 'weekday' => '*', 'command' => data.split(/\s+/, 2).at(1) }
+      when /@weekly .*/
+        { 'minute' => '0', 'hour' => '0', 'day' => '*', 'month' => '*', 'weekday' => '0', 'command' => data.split(/\s+/, 2).at(1) }
+      when /@monthly ./
+        { 'minute' => '0', 'hour' => '0', 'day' => '1', 'month' => '*', 'weekday' => '*', 'command' => data.split(/\s+/, 2).at(1) }
+      when /@(annually|yearly) .*/
+        { 'minute' => '0', 'hour' => '0', 'day' => '1', 'month' => '1', 'weekday' => '*', 'command' => data.split(/\s+/, 2).at(1) }
+      when /@reboot .*/
+        { 'minute' => '-1', 'hour' => '-1', 'day' => '-1', 'month' => '-1', 'weekday' => '-1', 'command' => data.split(/\s+/, 2).at(1) }
+      else
+        elements = data.split(/\s+/, 6)
+        {
+          'minute'  => elements.at(0),
+          'hour'    => elements.at(1),
+          'day'     => elements.at(2),
+          'month'   => elements.at(3),
+          'weekday' => elements.at(4),
+          'command' => elements.at(5),
+        }
+      end
+    end
+
+    def crontab_cmd
+      @user.nil? ? 'crontab -l' : "crontab -l -u #{@user}"
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:minutes,  field: 'minute')
+          .add(:hours,    field: 'hour')
+          .add(:days,     field: 'day')
+          .add(:months,   field: 'month')
+          .add(:weekdays, field: 'weekday')
+          .add(:commands, field: 'command')
+
+    # rebuild the crontab line from raw content
+    filter.add(:content) { |t, _|
+      t.entries.map do |e|
+        [e.minute, e.hour, e.day, e.month, e.weekday, e.command].join(' ')
+      end.join("\n")
+    }
+
+    filter.connect(self, :params)
+
+    def to_s
+      @user.nil? ? 'crontab for current user' : "crontab for user #{@user}"
+    end
+  end
+end

data/lib/resources/csv.rb

@@ -15,19 +15,36 @@ module Inspec::Resources
       end
     "
 
-    # override file load and parse hash from csv
+    # override the parse method from JsonConfig
+    # Assuming a header row of name,col1,col2, it will output an array of hashes like so:
+    #    [
+    #      { 'name' => 'row1', 'col1' => 'value1', 'col2' => 'value2' },
+    #      { 'name' => 'row2', 'col1' => 'value3', 'col2' => 'value4' }
+    #    ]
     def parse(content)
       require 'csv'
+
       # convert empty field to nil
       CSV::Converters[:blank_to_nil] = lambda do |field|
         field && field.empty? ? nil : field
       end
+
       # implicit conversion of values
       csv = CSV.new(content, headers: true, converters: [:all, :blank_to_nil])
+
       # convert to hash
       csv.to_a.map(&:to_hash)
     end
 
+    # override the value method from JsonConfig
+    # The format of the CSV hash as created by #parse is very different
+    # than what the YAML, JSON, and INI resources create, so using the
+    # #value method from JsonConfig (which uses ObjectTraverser.extract_value)
+    # doesn't make sense here.
+    def value(key)
+      @params.map { |x| x[key.first.to_s] }.compact
+    end
+
     def to_s
       "Csv #{@path}"
     end