inspec 1.0.0 → 1.35.1

data/lib/resources/mssql_session.rb

@@ -1,33 +1,102 @@
 # encoding: utf-8
+# author: Nolan Davidson
 # author: Christoph Hartmann
 # author: Dominik Richter
 
+require 'hashie/mash'
+require 'utils/database_helpers'
+
 module Inspec::Resources
+  # STABILITY: Experimental
+  # This resource needs further testing and refinement
+  #
+  # This requires the `sqlcmd` tool available on platform
+  # @see https://docs.microsoft.com/en-us/sql/relational-databases/scripting/sqlcmd-use-the-utility
+  # @see https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-connect-and-query-sqlcmd
   class MssqlSession < Inspec.resource(1)
     name 'mssql_session'
     desc 'Use the mssql_session InSpec audit resource to test SQL commands run against a MS Sql Server database.'
     example "
-      sql = mssql_session('myuser','mypassword')
-      describe sql.query('select * from sys.databases where name like \'*test*\') do
-        its('stdout') {should_not match(/test/) }
+      # Using SQL authentication
+      sql = mssql_session(user: 'myuser', pass: 'mypassword')
+      describe sql.query('SELECT * FROM table').row(0).column('columnname') do
+        its('value') { should cmp == 1 }
+      end
+
+      # Passing no credentials to mssql_session forces it to use Windows authentication
+      sql_windows_auth = mssql_session
+      describe sql.query(\"SELECT SERVERPROPERTY('IsIntegratedSecurityOnly') as \\\"login_mode\\\";\").row(0).column('login_mode') do
+        its('value') { should_not be_empty }
+        its('value') { should cmp == 1 }
       end
     "
 
-    def initialize(user = nil, pass = nil)
-      @user = user
-      @pass = pass
-      skip_resource('user and pass are required for MSSQL tests') if @user.nil? or @pass.nil?
+    attr_reader :user, :password, :host
+    def initialize(opts = {})
+      @user = opts[:user]
+      @password = opts[:password] || opts[:pass]
+      if opts[:pass]
+        warn '[DEPRECATED] use `password` option to supply password instead of `pass`'
+      end
+      @host = opts[:host] || 'localhost'
+      @instance = opts[:instance]
+
+      # check if sqlcmd is available
+      return skip_resource('sqlcmd is missing') if !inspec.command('sqlcmd').exist?
+      # check that database is reachable
+      return skip_resource("Can't connect to the MS SQL Server.") if !test_connection
     end
 
     def query(q)
-      escaped_query = q.gsub(/\\/, '\\\\').gsub(/"/, '\\"').gsub(/\$/, '\\$').gsub(/\@/, '`@')
-      cmd = inspec.command("sqlcmd -U #{@user} -P #{@pass} -Q \"#{escaped_query}\"")
-
-      cmd
+      escaped_query = q.gsub(/\\/, '\\\\').gsub(/"/, '\\"').gsub(/\$/, '\\$')
+      # surpress 'x rows affected' in SQLCMD with 'set nocount on;'
+      cmd_string = "sqlcmd -Q \"set nocount on; #{escaped_query}\" -W -w 1024 -s ','"
+      cmd_string += " -U #{@user} -P '#{@password}'" unless @user.nil? || @password.nil?
+      if @instance.nil?
+        cmd_string += " -S #{@host}"
+      else
+        cmd_string += " -S #{@host}\\#{@instance}"
+      end
+      cmd = inspec.command(cmd_string)
+      out = cmd.stdout + "\n" + cmd.stderr
+      if cmd.exit_status != 0 || out =~ /Sqlcmd: Error/
+        # TODO: we need to throw an exception here
+        # change once https://github.com/chef/inspec/issues/1205 is in
+        warn "Could not execute the sql query #{out}"
+        DatabaseHelper::SQLQueryResult.new(cmd, Hashie::Mash.new({}))
+      else
+        DatabaseHelper::SQLQueryResult.new(cmd, parse_csv_result(cmd))
+      end
     end
 
     def to_s
-      'MSSQL'
+      'MSSQL session'
+    end
+
+    private
+
+    def test_connection
+      !query('select getdate()').empty?
+    end
+
+    def parse_csv_result(cmd)
+      require 'csv'
+      table = CSV.parse(cmd.stdout, { headers: true })
+
+      # remove first row, since it will be a seperator line
+      table.delete(0)
+
+      # convert to hash
+      headers = table.headers
+
+      results = table.map { |row|
+        res = {}
+        headers.each { |header|
+          res[header.downcase] = row[header]
+        }
+        Hashie::Mash.new(res)
+      }
+      results
     end
   end
 end

data/lib/resources/mysql.rb

@@ -2,7 +2,6 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Dominik Richter
 # author: Christoph Hartmann
-# license: All rights reserved
 
 module Inspec::Resources
   class Mysql < Inspec.resource(1)

data/lib/resources/mysql_conf.rb

@@ -1,7 +1,6 @@
 # encoding: utf-8
 # copyright: 2015, Vulcano Security GmbH
 # author: Dominik Richter
-# license: All rights reserved
 
 require 'utils/simpleconfig'
 require 'utils/find_files'
@@ -73,7 +72,7 @@ module Inspec::Resources
         return skip_resource "Can't find file \"#{@conf_path}\""
       end
       raw_conf = read_file(@conf_path)
-      if raw_conf.empty? && inspec.file(@conf_path).size > 0
+      if raw_conf.empty? && !inspec.file(@conf_path).empty?
         return skip_resource("Can't read file \"#{@conf_path}\"")
       end
 

data/lib/resources/mysql_session.rb

@@ -2,22 +2,25 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Dominik Richter
 # author: Christoph Hartmann
-# license: All rights reserved
+# author: Aaron Lippold
 
 module Inspec::Resources
   class MysqlSession < Inspec.resource(1)
     name 'mysql_session'
     desc 'Use the mysql_session InSpec audit resource to test SQL commands run against a MySQL database.'
     example "
-      sql = mysql_session('my_user','password')
+      sql = mysql_session('my_user','password','host')
       describe sql.query('show databases like \'test\';') do
         its('stdout') { should_not match(/test/) }
       end
     "
 
-    def initialize(user = nil, pass = nil)
+    def initialize(user = nil, pass = nil, host = 'localhost', port = nil, socket = nil)
       @user = user
       @pass = pass
+      @host = host
+      @port = port
+      @socket = socket
       init_fallback if user.nil? or pass.nil?
       skip_resource("Can't run MySQL SQL checks without authentication") if @user.nil? or @pass.nil?
     end
@@ -28,12 +31,20 @@ module Inspec::Resources
       escaped_query = q.gsub(/\\/, '\\\\').gsub(/"/, '\\"').gsub(/\$/, '\\$')
 
       # run the query
-      cmd = inspec.command("mysql -u#{@user} -p#{@pass} #{db} -s -e \"#{escaped_query}\"")
+      command = "mysql -u#{@user} -p#{@pass}"
+      if !@socket.nil?
+        command += " -S #{@socket}"
+      else
+        command += " -h #{@host}"
+      end
+      command += " --port #{@port}" unless @port.nil?
+      command += " #{db} -s -e \"#{escaped_query}\""
+
+      cmd = inspec.command(command)
       out = cmd.stdout + "\n" + cmd.stderr
-      if out =~ /Can't connect to .* MySQL server/ or
-         out.downcase =~ /^error/
+      if out =~ /Can't connect to .* MySQL server/ || out.downcase =~ /^error/
         # skip this test if the server can't run the query
-        skip_resource("Can't connect to MySQL instance for SQL checks.")
+        warn("Can't connect to MySQL instance for SQL checks.")
       end
 
       # return the raw command output

data/lib/resources/nginx_conf.rb

@@ -0,0 +1,95 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'utils/nginx_parser'
+
+# STABILITY: Experimental
+# This resouce needs a proper interace to the underlying data, which is currently missing.
+# Until it is added, we will keep it experimental.
+#
+# TODO: Support it on Windows. To do so, we need to recognize the base os and how
+# it combines the file path. Calling `File.join` or similar methods may lead to errors
+# when running remotely.
+module Inspec::Resources
+  class NginxConf < Inspec.resource(1)
+    name 'nginx_conf'
+    desc 'Use the nginx_conf InSpec resource to test configuration data '\
+         'for the NginX web server located in /etc/nginx/nginx.conf on '\
+         'Linux and UNIX platforms.'
+    example "
+      describe nginx_conf.params ...
+      describe nginx_conf('/path/to/my/nginx.conf').params ...
+    "
+
+    attr_reader :contents
+
+    def initialize(conf_path = nil)
+      @conf_path = conf_path || '/etc/nginx/nginx.conf'
+      @contents = {}
+      return skip_resource 'The `nginx_conf` resource is currently not supported on Windows.' if inspec.os.windows?
+    end
+
+    def params
+      @params ||= parse_nginx(@conf_path)
+    rescue StandardError => e
+      skip_resource e.message
+      @params = {}
+    end
+
+    def to_s
+      "nginx_conf #{@conf_path}"
+    end
+
+    private
+
+    def read_content(path)
+      return @contents[path] if @contents.key?(path)
+      file = inspec.file(path)
+      if !file.file?
+        return skip_resource "Can't find file \"#{path}\""
+      end
+      @contents[path] = file.content
+    end
+
+    def parse_nginx(path)
+      return nil if inspec.os.windows?
+      content = read_content(path)
+      data = NginxConfig.parse(content)
+      resolve_references(data, File.dirname(path))
+    rescue StandardError => _
+      raise "Cannot parse NginX config in #{path}."
+    end
+
+    # Cycle through the complete parsed data structure and try to find any
+    # calls to `include`. In NginX, this is used to embed data from other
+    # files into the current data structure.
+    #
+    # The method steps through the object structure that is passed in to
+    # find any calls to 'include' and returns the object structure with the
+    # included data merged in.
+    #
+    # @param data [Hash] data structure from NginxConfig.parse
+    # @param rel_path [String] the relative path from which this config is read
+    # @return [Hash] data structure with references included
+    def resolve_references(data, rel_path)
+      # Walk through all array entries to find more references
+      return data.map { |x| resolve_references(x, rel_path) } if data.is_a?(Array)
+
+      # Return any data that we cannot step into to find more `include` calls
+      return data unless data.is_a?(Hash)
+
+      # Any call to `include` gets its data read, parsed, and merged back
+      # into the current data structure
+      if data.key?('include')
+        data.delete('include').flatten
+            .map { |x| File.expand_path(x, rel_path) }
+            .map { |path| parse_nginx(path) }
+            .map { |e| data.merge!(e) }
+      end
+
+      # Walk through the remaining hash fields to find more references
+      Hash[data.map { |k, v| [k, resolve_references(v, rel_path)] }]
+    end
+  end
+end

data/lib/resources/ntp_conf.rb

@@ -2,7 +2,6 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Christoph Hartmann
 # author: Dominik Richter
-# license: All rights reserved
 
 require 'utils/simpleconfig'
 
@@ -43,7 +42,7 @@ module Inspec::Resources
       end
 
       content = inspec.file(@conf_path).content
-      if content.empty? && inspec.file(@conf_path).size > 0
+      if content.empty? && !inspec.file(@conf_path).empty?
         skip_resource "Can't read file \"#{@conf_path}\""
         return @params = {}
       end
@@ -51,7 +50,7 @@ module Inspec::Resources
       # parse the file
       conf = SimpleConfig.new(
         content,
-        assignment_re: /^\s*(\S+)\s+(.*)\s*$/,
+        assignment_regex: /^\s*(\S+)\s+(.*)\s*$/,
         multiple_values: true,
       )
       @params = conf.params

data/lib/resources/oracledb_session.rb

@@ -0,0 +1,138 @@
+# encoding: utf-8
+# author: Nolan Davidson
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+require 'hashie/mash'
+require 'utils/database_helpers'
+require 'htmlentities'
+require 'rexml/document'
+require 'csv'
+
+module Inspec::Resources
+  # STABILITY: Experimental
+  # This resource needs further testing and refinement
+  #
+  class OracledbSession < Inspec.resource(1)
+    name 'oracledb_session'
+    desc 'Use the oracledb_session InSpec resource to test commands against an Oracle database'
+    example "
+      sql = oracledb_session(user: 'my_user', pass: 'password')
+      describe sql.query(\"SELECT UPPER(VALUE) AS VALUE FROM V$PARAMETER WHERE UPPER(NAME)='AUDIT_SYS_OPERATIONS'\").row(0).column('value') do
+        its('value') { should eq 'TRUE' }
+      end
+    "
+
+    attr_reader :user, :password, :host, :service
+    def initialize(opts = {})
+      @user = opts[:user]
+      @password = opts[:password] || opts[:pass]
+      if opts[:pass]
+        warn '[DEPRECATED] use `password` option to supply password instead of `pass`'
+      end
+
+      @host = opts[:host] || 'localhost'
+      @port = opts[:port] || '1521'
+      @service = opts[:service]
+
+      # we prefer sqlci although it is way slower than sqlplus, but it understands csv properly
+      @sqlcl_bin = 'sql'
+      @sqlplus_bin = opts[:sqlplus_bin] || 'sqlplus'
+
+      return skip_resource "Can't run Oracle checks without authentication" if @user.nil? || @password.nil?
+      return skip_resource 'You must provide a service name for the session' if @service.nil?
+    end
+
+    def query(q)
+      escaped_query = q.gsub(/\\/, '\\\\').gsub(/"/, '\\"')
+      # escape tables with $
+      escaped_query = escaped_query.gsub('$', '\\$')
+
+      p = nil
+      # use sqlplus if sqlcl is not available
+      if inspec.command(@sqlcl_bin).exist?
+        bin = @sqlcl_bin
+        opts = "set sqlformat csv\nSET FEEDBACK OFF"
+        p = :parse_csv_result
+      else
+        bin = @sqlplus_bin
+        opts = "SET MARKUP HTML ON\nSET FEEDBACK OFF"
+        p = :parse_html_result
+      end
+
+      command = "echo \"#{opts}\n#{verify_query(escaped_query)}\nEXIT\" | #{bin} -s #{@user}/#{@password}@//#{@host}:#{@port}/#{@service}"
+      cmd = inspec.command(command)
+
+      out = cmd.stdout + "\n" + cmd.stderr
+      if out.downcase =~ /^error/
+        # TODO: we need to throw an exception here
+        # change once https://github.com/chef/inspec/issues/1205 is in
+        warn "Could not execute the sql query #{out}"
+        DatabaseHelper::SQLQueryResult.new(cmd, Hashie::Mash.new({}))
+      end
+      DatabaseHelper::SQLQueryResult.new(cmd, send(p, cmd.stdout))
+    end
+
+    def to_s
+      'Oracle Session'
+    end
+
+    private
+
+    def verify_query(query)
+      # ensure we have a ; at the end
+      query + ';' if !query.strip.end_with?(';')
+      query
+    end
+
+    def parse_csv_result(stdout)
+      output = stdout.delete(/\r/)
+      table = CSV.parse(output, { headers: true })
+
+      # convert to hash
+      headers = table.headers
+
+      results = table.map { |row|
+        res = {}
+        headers.each { |header|
+          res[header.downcase] = row[header]
+        }
+        Hashie::Mash.new(res)
+      }
+      results
+    end
+
+    def parse_html_result(stdout) # rubocop:disable Metrics/AbcSize
+      result = stdout
+      # make oracle html valid html by removing the p tag, it does not include a closing tag
+      result = result.gsub('<p>', '').gsub('</p>', '').gsub('<br>', '')
+      doc = REXML::Document.new result
+      table = doc.elements['table']
+      hash = []
+      if !table.nil?
+        rows = table.elements.to_a
+        headers = rows[0].elements.to_a('th').map { |entry| entry.text.strip }
+        rows.delete_at(0)
+
+        # iterate over each row, first row is header
+        hash = []
+        if !rows.nil? && !rows.empty?
+          hash = rows.map { |row|
+            res = {}
+            entries = row.elements.to_a('td')
+            # ignore if we have empty entries, oracle is adding th rows in between
+            return nil if entries.empty?
+            headers.each_with_index { |header, index|
+              # we need htmlentities since we do not have nokogiri
+              coder = HTMLEntities.new
+              val = coder.decode(entries[index].text).strip
+              res[header.downcase] = val
+            }
+            Hashie::Mash.new(res)
+          }.compact
+        end
+      end
+      hash
+    end
+  end
+end

data/lib/resources/os_env.rb

@@ -2,7 +2,6 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Christoph Hartmann
 # author: Dominik Richter
-# license: All rights reserved
 
 # Usage:
 #
@@ -26,8 +25,6 @@ module Inspec::Resources
     attr_reader :content
     def initialize(env = nil)
       @osenv = env
-      @content = nil
-      @content = value_for(env) unless env.nil?
     end
 
     def split
@@ -36,7 +33,12 @@ module Inspec::Resources
       path_separator = inspec.os.windows? ? ';' : ':'
       # -1 is required to catch cases like dir1::dir2:
       # where we have a trailing :
-      @content.nil? ? [] : @content.split(path_separator, -1)
+      content.nil? ? [] : content.split(path_separator, -1)
+    end
+
+    def content
+      return @content if defined?(@content)
+      @content = value_for(@osenv) unless @osenv.nil?
     end
 
     def to_s
@@ -59,7 +61,7 @@ module Inspec::Resources
       out = inspec.command(command)
 
       unless out.exit_status == 0
-        skip_resource "Can't read environment variables on #{os[:name]}. "\
+        skip_resource "Can't read environment variables on #{inspec.os.name}. "\
           "Tried `#{command}` which returned #{out.exit_status}"
       end
 

data/lib/resources/package.rb

@@ -15,11 +15,12 @@ module Inspec::Resources
     example "
       describe package('nginx') do
         it { should be_installed }
+        it { should_not be_held } # for dpkg platforms that support holding a version from being upgraded
         its('version') { should eq 1.9.5 }
       end
     "
 
-    def initialize(package_name = nil) # rubocop:disable Metrics/AbcSize
+    def initialize(package_name = nil, opts = {}) # rubocop:disable Metrics/AbcSize
       @package_name = package_name
       @name = @package_name
       @cache = nil
@@ -29,8 +30,8 @@ module Inspec::Resources
       os = inspec.os
       if os.debian?
         @pkgman = Deb.new(inspec)
-      elsif %w{redhat suse amazon fedora}.include?(os[:family])
-        @pkgman = Rpm.new(inspec)
+      elsif os.redhat? || %w{suse amazon fedora}.include?(os[:family])
+        @pkgman = Rpm.new(inspec, opts)
       elsif ['arch'].include?(os[:family])
         @pkgman = Pacman.new(inspec)
       elsif ['darwin'].include?(os[:family])
@@ -46,6 +47,8 @@ module Inspec::Resources
       else
         return skip_resource 'The `package` resource is not supported on your OS yet.'
       end
+
+      evaluate_missing_requirements
     end
 
     # returns true if the package is installed
@@ -54,6 +57,13 @@ module Inspec::Resources
       info[:installed] == true
     end
 
+    # returns true it the package is held (if the OS supports it)
+    def held?(_provider = nil, _version = nil)
+      return false if info.nil?
+      return false unless info.key?(:held)
+      info[:held] == true
+    end
+
     # returns the package description
     def info
       return @cache if !@cache.nil?
@@ -71,6 +81,14 @@ module Inspec::Resources
     def to_s
       "System Package #{@package_name}"
     end
+
+    private
+
+    def evaluate_missing_requirements
+      missing_requirements_string = @pkgman.missing_requirements.uniq.join(', ')
+      return if missing_requirements_string.empty?
+      skip_resource "The following requirements are not met for this resource: #{missing_requirements_string}"
+    end
   end
 
   class PkgManagement
@@ -78,6 +96,12 @@ module Inspec::Resources
     def initialize(inspec)
       @inspec = inspec
     end
+
+    def missing_requirements
+      # Each provider can provide an Array of missing requirements that will be
+      # combined into a `skip_resource` message
+      []
+    end
   end
 
   # Debian / Ubuntu
@@ -88,14 +112,17 @@ module Inspec::Resources
 
       params = SimpleConfig.new(
         cmd.stdout.chomp,
-        assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
         multiple_values: false,
       ).params
+      # If the package is installed, Status is "install ok installed"
+      # If the package is installed and marked hold, Status is "hold ok installed"
       # If the package is removed and not purged, Status is "deinstall ok config-files" with exit_status 0
       # If the package is purged cmd fails with non-zero exit status
       {
         name: params['Package'],
-        installed: params['Status'].split(' ').first == 'install',
+        installed: params['Status'].split(' ')[2] == 'installed',
+        held: params['Status'].split(' ')[0] == 'hold',
         version: params['Version'],
         type: 'deb',
       }
@@ -104,14 +131,31 @@ module Inspec::Resources
 
   # RHEL family
   class Rpm < PkgManagement
+    def initialize(inspec, opts)
+      super(inspec)
+
+      @dbpath = opts.fetch(:rpm_dbpath, nil)
+    end
+
+    def missing_requirements
+      missing_requirements = []
+
+      unless @dbpath.nil? || inspec.directory(@dbpath).directory?
+        missing_requirements << "RPMDB #{@dbpath} does not exist"
+      end
+
+      missing_requirements
+    end
+
     def info(package_name)
-      cmd = inspec.command("rpm -qia #{package_name}")
+      rpm_cmd = rpm_command(package_name)
+      cmd = inspec.command(rpm_cmd)
       # CentOS does not return an error code if the package is not installed,
       # therefore we need to check for emptyness
       return nil if cmd.exit_status.to_i != 0 || cmd.stdout.chomp.empty?
       params = SimpleConfig.new(
         cmd.stdout.chomp,
-        assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
         multiple_values: false,
       ).params
       # On some (all?) systems, the linebreak before the vendor line is missing
@@ -133,6 +177,17 @@ module Inspec::Resources
         type: 'rpm',
       }
     end
+
+    private
+
+    def rpm_command(package_name)
+      cmd = ''
+      cmd += 'rpm -qia'
+      cmd += " --dbpath #{@dbpath}" if @dbpath
+      cmd += ' ' + package_name
+
+      cmd
+    end
   end
 
   # MacOS / Darwin implementation
@@ -143,11 +198,13 @@ module Inspec::Resources
       # parse data
       pkg = JSON.parse(cmd.stdout)[0]
       {
-        name: pkg.name.to_s,
+        name: pkg['name'],
         installed: true,
-        version: pkg.installed.version.to_s,
+        version: pkg['installed'][0]['version'],
         type: 'brew',
       }
+    rescue JSON::ParserError => _e
+      return nil
     end
   end
 
@@ -159,7 +216,7 @@ module Inspec::Resources
 
       params = SimpleConfig.new(
         cmd.stdout.chomp,
-        assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
         multiple_values: false,
       ).params
 
@@ -204,7 +261,7 @@ module Inspec::Resources
       # Find the package
       cmd = inspec.command <<-EOF.gsub(/^\s*/, '')
         Get-ItemProperty (@("#{search_paths.join('", "')}") | Where-Object { Test-Path $_ }) |
-        Where-Object { $_.DisplayName -like "#{package_name}*" -or $_.PSChildName -like "#{package_name}" } |
+        Where-Object { $_.DisplayName -like "#{package_name}" -or $_.PSChildName -like "#{package_name}" } |
         Select-Object -Property DisplayName,DisplayVersion | ConvertTo-Json
       EOF
 
@@ -259,7 +316,7 @@ module Inspec::Resources
 
       params = SimpleConfig.new(
         cmd.stdout.chomp,
-        assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
         multiple_values: false,
       ).params
 
@@ -280,7 +337,7 @@ module Inspec::Resources
 
       params = SimpleConfig.new(
         cmd.stdout.chomp,
-        assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
         multiple_values: false,
       ).params