inspec 1.31.0 → 1.45.9

data/lib/inspec/dependencies/resolver.rb

@@ -71,7 +71,7 @@ module Inspec
         end
 
         if !dep.source_satisfies_spec?
-          raise Inspec::UnsatisfiedVersionSpecification, "The profile #{dep.name} from #{dep.resolved_source} has a version #{dep.source_version} which doesn't match #{dep.required_version}"
+          raise Inspec::UnsatisfiedVersionSpecification, "The profile #{dep.name} from #{dep.resolved_source} has a version #{dep.source_version} which doesn't match #{dep.version_constraints}"
         end
 
         Inspec::Log.debug("Adding dependency #{dep.name} (#{dep.resolved_source})")

data/lib/inspec/exceptions.rb

@@ -3,6 +3,10 @@
 
 module Inspec
   module Exceptions
+    class AttributesFileDoesNotExist < ArgumentError; end
+    class AttributesFileNotReadable < ArgumentError; end
+    class ResourceFailed < StandardError; end
+    class ResourceSkipped < StandardError; end
     class SecretsBackendNotFound < ArgumentError; end
   end
 end

data/lib/inspec/file_provider.rb

@@ -72,7 +72,7 @@ module Inspec
       @files = if File.file?(path)
                  [path]
                else
-                 Dir[File.join(path, '**', '*')]
+                 Dir[File.join(Shellwords.shellescape(path), '**', '*')]
                end
       @path = path
     end
@@ -97,9 +97,10 @@ module Inspec
       @path = path
       @contents = {}
       @files = []
-      ::Zip::InputStream.open(@path) do |io|
+      walk_zip(@path) do |io|
         while (entry = io.get_next_entry)
-          @files.push(entry.name.sub(%r{/+$}, ''))
+          name = entry.name.sub(%r{/+$}, '')
+          @files.push(name) unless name.empty?
         end
       end
     end
@@ -110,10 +111,14 @@ module Inspec
 
     private
 
+    def walk_zip(path, &callback)
+      ::Zip::InputStream.open(path, &callback)
+    end
+
     def read_from_zip(file)
       return nil unless @files.include?(file)
       res = nil
-      ::Zip::InputStream.open(@path) do |io|
+      walk_zip(@path) do |io|
         while (entry = io.get_next_entry)
           next unless file == entry.name
           res = io.read
@@ -131,8 +136,17 @@ module Inspec
       @path = path
       @contents = {}
       @files = []
-      Gem::Package::TarReader.new(Zlib::GzipReader.open(@path)) do |tar|
-        @files = tar.map(&:full_name)
+      walk_tar(@path) do |tar|
+        @files = tar.find_all(&:file?)
+
+        # delete all entries with no name
+        @files = @files.find_all { |x| !x.full_name.empty? }
+
+        # delete all entries that have a PaxHeader
+        @files = @files.delete_if { |x| x.full_name.include?('PaxHeader/') }
+
+        # replace all items of the array simply with the relative filename of the file
+        @files.map! { |x| Pathname.new(x.full_name).relative_path_from(Pathname.new('.')).to_s }
       end
     end
 
@@ -142,13 +156,17 @@ module Inspec
 
     private
 
+    def walk_tar(path, &callback)
+      Gem::Package::TarReader.new(Zlib::GzipReader.open(path), &callback)
+    end
+
     def read_from_tar(file)
       return nil unless @files.include?(file)
       res = nil
       # NB `TarReader` includes `Enumerable` beginning with Ruby 2.x
-      Gem::Package::TarReader.new(Zlib::GzipReader.open(@path)) do |tar|
+      walk_tar(@path) do |tar|
         tar.each do |entry|
-          next unless entry.file? && file == entry.full_name
+          next unless entry.file? && [file, "./#{file}"].include?(entry.full_name)
           res = entry.read
           break
         end
@@ -173,8 +191,19 @@ module Inspec
       if @prefix.nil?
         raise "Could not determine path prefix for #{parent}"
       end
-      @files = parent.files.find_all { |x| x.start_with?(prefix) && x != prefix }
+
+      # select all files that begin with the prefix, and strip off the prefix from the file.
+      #
+      # strip off any leading top-level relative path (./) which is common in
+      # PAX-formatted tar files. Do not do any translation of the path if the
+      # path is an absolute path.
+      @files = parent.files
+                     .find_all { |x| x.start_with?(prefix) && x != prefix }
                      .map { |x| x[prefix.length..-1] }
+                     .map do |x|
+                       path = Pathname.new(x)
+                       path.absolute? ? path.to_s : path.relative_path_from(Pathname.new('.')).to_s
+                     end
     end
 
     def abs_path(file)

data/lib/inspec/metadata.rb

@@ -11,6 +11,9 @@ require 'utils/spdx'
 
 module Inspec
   # Extract metadata.rb information
+  # A Metadata object may be created and finalized with invalid data.
+  # This allows the check CLI command to analyse the issues.
+  # Use valid? to determine if the metadata is coherent.
   class Metadata # rubocop:disable Metrics/ClassLength
     attr_reader :ref
     attr_accessor :params, :content
@@ -112,6 +115,12 @@ module Inspec
         errors.push("Missing profile #{field} in #{ref}")
       end
 
+      if params[:name] =~ %r{[\/\\]}
+        warnings.push("Your profile name (#{params[:name]}) contains a slash " \
+          'which will not be permitted in InSpec 2.0. Please change your profile ' \
+          'name in the `inspec.yml` file.')
+      end
+
       # if version is set, ensure it is correct
       if !params[:version].nil? && !valid_version?(params[:version])
         errors.push('Version needs to be in SemVer format')
@@ -180,7 +189,7 @@ module Inspec
         logger.warn(
           "Do not use deprecated `supports: #{x}` syntax. Instead use:\n"\
           "supports:\n  - os-family: #{x}\n\n")
-        { :'os-family' => x }
+        { :'os-family' => x } # rubocop:disable Style/HashSyntax
       end
     end
 
@@ -194,7 +203,7 @@ module Inspec
         logger.warn(
           "Do not use deprecated `supports: #{x}` syntax. Instead use:\n"\
           "supports:\n  - os-family: #{x}\n\n")
-        [{ :'os-family' => x }]
+        [{ :'os-family' => x }] # rubocop:disable Style/HashSyntax
       end
     end
 
@@ -212,7 +221,12 @@ module Inspec
       return unless metadata.params[:title].nil?
 
       # create a new name based on the original target if it exists
-      metadata.params[:name] = "tests from #{original_target}" unless original_target.to_s.empty?
+      # Crudely slug the target to not contain slashes, to avoid breaking
+      # unit tests that look for warning sequences
+      unless original_target.to_s.empty?
+        metadata.params[:title] = "tests from #{original_target}"
+        metadata.params[:name] = metadata.params[:title].gsub(%r{[\\\/]}, '.')
+      end
     end
 
     def self.finalize(metadata, profile_id, options, logger = nil)

data/lib/inspec/objects/attribute.rb

@@ -3,22 +3,31 @@
 module Inspec
   class Attribute
     attr_accessor :name
-    def initialize(name, options)
+    attr_writer :value
+
+    DEFAULT_ATTRIBUTE = Class.new do
+      def method_missing(*_)
+        self
+      end
+
+      def respond_to_missing?(_, _)
+        true
+      end
+    end
+
+    def initialize(name, options = {})
       @name = name
       @opts = options
       @value = nil
     end
 
     # implicit call is done by inspec to determine the value of an attribute
-    def value(newvalue = nil)
-      unless newvalue.nil?
-        @value = newvalue
-      end
-      @value || default
+    def value
+      @value.nil? ? default : @value
     end
 
     def default
-      @opts[:default]
+      @opts[:default] || DEFAULT_ATTRIBUTE.new
     end
 
     def title

data/lib/inspec/objects/control.rb

@@ -2,10 +2,11 @@
 
 module Inspec
   class Control
-    attr_accessor :id, :title, :desc, :impact, :tests, :tags
+    attr_accessor :id, :title, :desc, :impact, :tests, :tags, :refs
     def initialize
       @tests = []
       @tags = []
+      @refs = []
     end
 
     def add_test(t)
@@ -20,12 +21,13 @@ module Inspec
       { id: id, title: title, desc: desc, impact: impact, tests: tests.map(&:to_hash), tags: tags.map(&:to_hash) }
     end
 
-    def to_ruby
+    def to_ruby # rubocop:disable Metrics/AbcSize
       res = ["control #{id.inspect} do"]
       res.push "  title #{title.inspect}" unless title.to_s.empty?
       res.push "  desc  #{prettyprint_text(desc, 2)}" unless desc.to_s.empty?
       res.push "  impact #{impact}" unless impact.nil?
       tags.each { |t| res.push(indent(t.to_ruby, 2)) }
+      refs.each { |t| res.push("  ref   #{print_ref(t)}") }
       tests.each { |t| res.push(indent(t.to_ruby, 2)) }
       res.push 'end'
       res.join("\n")
@@ -33,6 +35,12 @@ module Inspec
 
     private
 
+    def print_ref(x)
+      return x.inspect if x.is_a?(String)
+      raise "Cannot process the ref: #{x}" unless x.is_a?(Hash)
+      '('+x.inspect+')'
+    end
+
     # Pretty-print a text block of InSpec code
     #
     # @param s [String] should not be empty

data/lib/inspec/plugins/resource.rb

@@ -37,14 +37,26 @@ module Inspec
       Inspec::Resource.registry
     end
 
-    def __register(name, obj)
+    def __register(name, obj) # rubocop:disable Metrics/MethodLength
       cl = Class.new(obj) do
+        attr_reader :resource_exception_message
+
         def initialize(backend, name, *args)
+          @resource_skipped = false
+          @resource_failed = false
+
           # attach the backend to this instance
           @__backend_runner__ = backend
           @__resource_name__ = name
+
           # call the resource initializer
-          super(*args)
+          begin
+            super(*args)
+          rescue Inspec::Exceptions::ResourceSkipped => e
+            skip_resource(e.message)
+          rescue Inspec::Exceptions::ResourceFailed => e
+            fail_resource(e.message)
+          end
         end
 
         def self.desc(description = nil)
@@ -57,12 +69,29 @@ module Inspec
           @example = example
         end
 
+        def skip_resource(message)
+          @resource_skipped = true
+          @resource_exception_message = message
+        end
+
+        def resource_skipped?
+          @resource_skipped
+        end
+
         def resource_skipped
-          @resource_skipped if defined?(@resource_skipped)
+          warn('[DEPRECATION] Use `resource_exception_message` for the resource skipped message. This method will be removed in InSpec 2.0.')
+          # Returning `nil` here to match previous behavior
+          return nil if @resource_skipped == false
+          @resource_exception_message
         end
 
-        def skip_resource(message)
-          @resource_skipped = message
+        def fail_resource(message)
+          @resource_failed = true
+          @resource_exception_message = message
+        end
+
+        def resource_failed?
+          @resource_failed
         end
 
         def inspec

data/lib/inspec/profile.rb

@@ -93,12 +93,21 @@ module Inspec
       @writable = options[:writable] || false
       @profile_id = options[:id]
       @cache = options[:cache] || Cache.new
-      @backend = options[:backend] || Inspec::Backend.create(options.select { |k, _| k != 'target' })
       @attr_values = options[:attributes]
       @tests_collected = false
       @libraries_loaded = false
       Metadata.finalize(@source_reader.metadata, @profile_id, options)
 
+      # if a backend has already been created, clone it so each profile has its own unique backend object
+      # otherwise, create a new backend object
+      #
+      # This is necessary since we store the RuntimeProfile on the backend object. If a user runs `inspec exec`
+      # with multiple profiles, only the RuntimeProfile for the last-loaded profile will be available if
+      # we share the backend between profiles.
+      #
+      # This will cause issues if a profile attempts to load a file via `inspec.profile.file`
+      train_options = options.select { |k, _| k != 'target' } # See https://github.com/chef/inspec/pull/1646
+      @backend = options[:backend].nil? ? Inspec::Backend.create(train_options) : options[:backend].dup
       @runtime_profile = RuntimeProfile.new(self)
       @backend.profile = @runtime_profile
 

data/lib/inspec/profile_context.rb

@@ -127,6 +127,8 @@ module Inspec
     end
 
     def load_control_file(*args)
+      # Set `skip_file` to `false` between file loads to prevent skips from spanning multiple control files
+      control_eval_context.skip_file = false
       load_with_context(control_eval_context, *args)
     end
     alias load load_control_file
@@ -177,7 +179,7 @@ module Inspec
       # we need to return an attribute object, to allow dermination of default values
       attr = Attribute.new(name, options)
       # read value from given gived values
-      attr.value(@conf['attributes'][attr.name]) unless @conf['attributes'].nil?
+      attr.value = @conf['attributes'][attr.name] unless @conf['attributes'].nil?
       @attributes.push(attr)
       attr.value
     end

data/lib/inspec/resource.rb

@@ -72,24 +72,33 @@ module Inspec
   end
 end
 
+require 'resources/aide_conf'
 require 'resources/apache'
 require 'resources/apache_conf'
 require 'resources/apt'
 require 'resources/audit_policy'
+require 'resources/auditd'
 require 'resources/auditd_conf'
 require 'resources/auditd_rules'
 require 'resources/bash'
 require 'resources/bond'
 require 'resources/bridge'
 require 'resources/command'
+require 'resources/cran'
+require 'resources/cpan'
 require 'resources/crontab'
 require 'resources/dh_params'
 require 'resources/directory'
 require 'resources/docker'
-require 'resources/docker_image'
 require 'resources/docker_container'
+require 'resources/docker_image'
+require 'resources/elasticsearch'
+require 'resources/etc_fstab'
 require 'resources/etc_group'
+require 'resources/etc_hosts_allow_deny'
+require 'resources/etc_hosts'
 require 'resources/file'
+require 'resources/firewalld'
 require 'resources/gem'
 require 'resources/groups'
 require 'resources/grub_conf'
@@ -111,6 +120,7 @@ require 'resources/mssql_session'
 require 'resources/mysql'
 require 'resources/mysql_conf'
 require 'resources/mysql_session'
+require 'resources/nginx'
 require 'resources/nginx_conf'
 require 'resources/npm'
 require 'resources/ntp_conf'
@@ -122,12 +132,12 @@ require 'resources/package'
 require 'resources/packages'
 require 'resources/parse_config'
 require 'resources/passwd'
-require 'resources/postgres_hba_conf'
-require 'resources/postgres_ident_conf'
 require 'resources/pip'
 require 'resources/port'
 require 'resources/postgres'
 require 'resources/postgres_conf'
+require 'resources/postgres_hba_conf'
+require 'resources/postgres_ident_conf'
 require 'resources/postgres_session'
 require 'resources/powershell'
 require 'resources/processes'
@@ -136,18 +146,19 @@ require 'resources/registry_key'
 require 'resources/security_policy'
 require 'resources/service'
 require 'resources/shadow'
-require 'resources/ssl'
 require 'resources/ssh_conf'
+require 'resources/ssl'
 require 'resources/sys_info'
 require 'resources/toml'
 require 'resources/users'
 require 'resources/vbscript'
 require 'resources/virtualization'
 require 'resources/windows_feature'
+require 'resources/windows_hotfix'
 require 'resources/windows_task'
-require 'resources/xinetd'
 require 'resources/wmi'
 require 'resources/x509_certificate'
+require 'resources/xinetd'
 require 'resources/yum'
 require 'resources/zfs_dataset'
 require 'resources/zfs_pool'
@@ -157,3 +168,4 @@ require 'resources/json'
 require 'resources/yaml'
 require 'resources/csv'
 require 'resources/ini'
+require 'resources/xml'

data/lib/inspec/rspec_json_formatter.rb

@@ -52,11 +52,20 @@ class InspecRspecMiniJson < RSpec::Core::Formatters::JsonFormatter
       format_example(example).tap do |hash|
         e = example.exception
         next unless e
-        hash[:message] = exception_message(e)
+
+        if example.metadata[:sensitive]
+          hash[:message] = '*** sensitive output suppressed ***'
+        else
+          hash[:message] = exception_message(e)
+        end
 
         next if e.is_a? RSpec::Expectations::ExpectationNotMetError
         hash[:exception] = e.class.name
         hash[:backtrace] = e.backtrace
+
+        # if the exception indicates the resource author wants to skip the test,
+        # we update the test status here.
+        hash[:status] = 'skipped' if e.is_a?(Inspec::Exceptions::ResourceSkipped)
       end
     end
   end
@@ -341,7 +350,7 @@ class InspecRspecCli < InspecRspecJson # rubocop:disable Metrics/ClassLength
   # This method is called through the RSpec Formatter interface for every
   # example found in the test suite.
   #
-  # Within #format_example we are getting and example and:
+  # Within #format_example we are getting an example and:
   #    * if this is an example, within a control, within a profile then we want
   #      to display the profile header, display the control, and then display
   #      the example.
@@ -566,7 +575,8 @@ class InspecRspecCli < InspecRspecJson # rubocop:disable Metrics/ClassLength
   end
 
   def print_result(result)
-    test_status = result[:status_type]
+    test_skipped = result[:status] == 'skipped'
+    test_status = test_skipped ? 'skipped' : result[:status_type]
     indicator = INDICATORS[result[:status]]
     indicator = INDICATORS['empty'] if indicator.nil?
     if result[:message]
@@ -613,10 +623,18 @@ class InspecRspecCli < InspecRspecJson # rubocop:disable Metrics/ClassLength
     summary = profile_summary
     return unless summary['total'] > 0
 
+    success_str = summary['passed'] == 1 ? '1 successful control' : "#{summary['passed']} successful controls"
+    failed_str  = summary['failed']['total'] == 1 ? '1 control failure' : "#{summary['failed']['total']} control failures"
+    skipped_str = summary['skipped'] == 1 ? '1 control skipped' : "#{summary['skipped']} controls skipped"
+
+    success_color = summary['passed'] > 0 ? 'passed' : 'no_color'
+    failed_color = summary['failed']['total'] > 0 ? 'failed' : 'no_color'
+    skipped_color = summary['skipped'] > 0 ? 'skipped' : 'no_color'
+
     s = format('Profile Summary: %s, %s, %s',
-               format_with_color('passed', "#{summary['passed']} successful"),
-               format_with_color('failed', "#{summary['failed']['total']} failures"),
-               format_with_color('skipped', "#{summary['skipped']} skipped"),
+               format_with_color(success_color, success_str),
+               format_with_color(failed_color, failed_str),
+               format_with_color(skipped_color, skipped_str),
               )
     output.puts(s) if summary['total'] > 0
   end
@@ -624,10 +642,16 @@ class InspecRspecCli < InspecRspecJson # rubocop:disable Metrics/ClassLength
   def print_tests_summary
     summary = tests_summary
 
+    failed_str = summary['failed'] == 1 ? '1 failure' : "#{summary['failed']} failures"
+
+    success_color = summary['passed'] > 0 ? 'passed' : 'no_color'
+    failed_color = summary['failed'] > 0 ? 'failed' : 'no_color'
+    skipped_color = summary['skipped'] > 0 ? 'skipped' : 'no_color'
+
     s = format('Test Summary: %s, %s, %s',
-               format_with_color('passed', "#{summary['passed']} successful"),
-               format_with_color('failed', "#{summary['failed']} failures"),
-               format_with_color('skipped', "#{summary['skipped']} skipped"),
+               format_with_color(success_color, "#{summary['passed']} successful"),
+               format_with_color(failed_color, failed_str),
+               format_with_color(skipped_color, "#{summary['skipped']} skipped"),
               )
 
     output.puts(s)
@@ -802,7 +826,9 @@ class InspecRspecCli < InspecRspecJson # rubocop:disable Metrics/ClassLength
     end
 
     def update_summary(example)
-      example_status = STATUS_TYPES[example[:status_type]]
+      test_skipped = example[:status] == 'skipped'
+      status_type = test_skipped ? 'skipped' : example[:status_type]
+      example_status = STATUS_TYPES[status_type]
       @summary_status = example_status if example_status > @summary_status
       fails.push(example) if example_status > 0
       passes.push(example) if example_status == STATUS_TYPES['passed']
@@ -855,8 +881,9 @@ class InspecRspecJUnit < InspecRspecJson
   private
 
   def build_profile_xml(profile)
+    profile_name = profile[:name]
     profile_xml = REXML::Element.new('testsuite')
-    profile_xml.add_attribute('name', profile[:name])
+    profile_xml.add_attribute('name', profile_name)
     profile_xml.add_attribute('tests', count_profile_tests(profile))
     profile_xml.add_attribute('failed', count_profile_failed_tests(profile))
 
@@ -864,17 +891,24 @@ class InspecRspecJUnit < InspecRspecJson
       next if control[:results].nil?
 
       control[:results].each do |result|
-        profile_xml.add(build_result_xml(control, result))
+        profile_xml.add(build_result_xml(profile_name, control, result))
       end
     end
 
     profile_xml
   end
 
-  def build_result_xml(control, result)
+  def build_result_xml(profile_name, control, result)
     result_xml = REXML::Element.new('testcase')
     result_xml.add_attribute('name', result[:code_desc])
-    result_xml.add_attribute('class', control[:title].nil? ? 'Anonymous' : control[:id])
+    # if there is no control title, we are likely receiving test results from a
+    # "naked" test (a test not located within a control block). Therefore, rather
+    # than outputting the auto-generated ID, i.e.
+    #
+    # "(generated from test_spec.rb:1 de0ce10e4bbbd4d0ff7a65f4234de8c1)")
+    #
+    # ... we'll output "Anonymous" instead.
+    result_xml.add_attribute('classname', control[:title].nil? ? "#{profile_name}.Anonymous" : "#{profile_name}.#{control[:id]}")
     result_xml.add_attribute('time', result[:run_time])
 
     if result[:status] == 'failed'

data/lib/inspec/rule.rb

@@ -94,6 +94,10 @@ module Inspec
       @tags
     end
 
+    def source_file
+      @__file
+    end
+
     # Skip all checks if only_if is false
     #
     # @param [Type] &block returns true if tests are added, false otherwise