inspec 1.31.0 → 1.45.9

data/lib/resources/xml.rb

@@ -0,0 +1,27 @@
+# encoding: utf-8
+# author: Jonathan Morley
+
+module Inspec::Resources
+  class XmlConfig < JsonConfig
+    name 'xml'
+    desc 'Use the xml InSpec resource to test configuration data in an XML file'
+    example "
+      describe xml('default.xml') do
+        its('key/sub_key') { should eq(['value']) }
+      end
+    "
+
+    def parse(content)
+      require 'rexml/document'
+      REXML::Document.new(content)
+    end
+
+    def value(key)
+      REXML::XPath.each(@params, key.first.to_s).map(&:text)
+    end
+
+    def to_s
+      "XML #{@path}"
+    end
+  end
+end

data/lib/source_readers/inspec.rb

@@ -54,21 +54,21 @@ module SourceReaders
       tests = @target.files.find_all do |path|
         path.start_with?('controls') && path.end_with?('.rb')
       end
-      Hash[tests.map { |x| [x, @target.read(x)] }]
+      Hash[tests.map { |x| [x, @target.read(x)] }.delete_if { |_file, contents| contents.nil? }]
     end
 
     def load_libs
       tests = @target.files.find_all do |path|
         path.start_with?('libraries') && path.end_with?('.rb')
       end
-      Hash[tests.map { |x| [x, @target.read(x)] }]
+      Hash[tests.map { |x| [x, @target.read(x)] }.delete_if { |_file, contents| contents.nil? }]
     end
 
     def load_data_files
       files = @target.files.find_all do |path|
         path.start_with?('files' + File::SEPARATOR)
       end
-      Hash[files.map { |x| [x, @target.read(x)] }]
+      Hash[files.map { |x| [x, @target.read(x)] }.delete_if { |_file, contents| contents.nil? }]
     end
   end
 end

data/lib/utils/find_files.rb

@@ -24,9 +24,10 @@ module FindFiles
     depth = opts[:depth]
     type = TYPES[opts[:type].to_sym] if opts[:type]
 
-    cmd = "find #{path}"
+    cmd = "sh -c \'find #{path}"
     cmd += " -type #{type}" unless type.nil?
     cmd += " -maxdepth #{depth.to_i}" if depth.to_i > 0
+    cmd += "\'"
 
     result = inspec.command(cmd)
     exit_status = result.exit_status

data/lib/utils/nginx_parser.rb

@@ -21,15 +21,24 @@ class NginxParser < Parslet::Parser
     (identifier >> values.maybe.as(:args)).as(:assignment) >> str(';') >> filler?
   }
 
-  rule(:identifier) {
+  rule(:standard_identifier) {
     (match('[a-zA-Z]') >> match('\S').repeat).as(:identifier) >> space >> space.repeat
   }
 
+  rule(:quoted_identifier) {
+    str('"') >> (str('"').absent? >> any).repeat.as(:identifier) >> str('"') >> space.repeat
+  }
+
+  rule(:identifier) {
+    standard_identifier | quoted_identifier
+  }
+
   rule(:value) {
     ((match('[#;{]').absent? >> any) >> (
       str('\\') >> any | match('[#;{]|\s').absent? >> any
     ).repeat).as(:value) >> space.repeat
   }
+
   rule(:values) {
     value.repeat >> space.maybe
   }

data/lib/utils/object_traversal.rb

@@ -3,22 +3,47 @@
 # author: Christoph Hartmann
 module ObjectTraverser
   def extract_value(keys, value)
+    return nil if value.nil?
+
     key = keys.shift
-    return nil if key.nil? || value.nil?
+    return nil if key.nil?
 
-    if value.is_a?(Array)
-      value = if key.is_a?(Fixnum)
-                value[key]
-              elsif value.respond_to?(key.to_sym)
-                value.send(key.to_sym)
-              end
-    else
-      value = value[key.to_s].nil? ? nil : value[key.to_s]
-    end
+    # if the current value is not a Hash or Array, it is undefined
+    # behavior so value will be assigned nil by default.
+    value = if value.is_a?(Array)
+              extract_from_array(key, value)
+            elsif value.is_a?(Hash)
+              extract_from_hash(key, value)
+            end
 
     # if there are no more keys, just return the value
     return value if keys.first.nil?
     # if there are more keys, extract more
     extract_value(keys.clone, value)
   end
+
+  private
+
+  # If the values to return from is an Array, allow returning by index.
+  # Otherwise, support methods on the Array itself.
+  def extract_from_array(key, value)
+    if key.is_a?(Fixnum)
+      value[key]
+    elsif value.respond_to?(key.to_sym)
+      value.send(key.to_sym)
+    end
+  end
+
+  # for Hashes, try to return the value by the key.
+  # We first try to find by the raw key before we stringify
+  # if the keys themselves are symbols, for example.
+  #
+  # This will return nil default if we can't find the key.
+  def extract_from_hash(key, value)
+    if value.key?(key)
+      value[key]
+    elsif value.key?(key.to_s)
+      value[key.to_s]
+    end
+  end
 end

data/lib/utils/parser.rb

@@ -67,7 +67,19 @@ module LinuxMountParser
   # this parses the output of mount command (only tested on linux)
   # this method expects only one line of the mount output
   def parse_mount_options(mount_line, compatibility = false)
-    mount = mount_line.scan(/\S+/)
+    if includes_whitespaces?(mount_line)
+      # Device-/Sharenames and Mountpoints including whitespaces require special treatment:
+      # We use the keyword ' type ' to split up and rebuild the desired array of fields
+      type_split = mount_line.split(' type ')
+      fs_path = type_split[0]
+      other_opts = type_split[1]
+      fs, path = fs_path.match(%r{^(.+?)\son\s(/.+?)$}).captures
+      mount = [fs, 'on', path, 'type']
+      mount.concat(other_opts.scan(/\S+/))
+    else
+      # ... otherwise we just split the fields by whitespaces
+      mount = mount_line.scan(/\S+/)
+    end
 
     # parse device and type
     mount_options    = { device: mount[0], type: mount[4] }
@@ -92,6 +104,12 @@ module LinuxMountParser
 
     mount_options
   end
+
+  # Device-/Sharename or Mountpoint includes whitespaces?
+  def includes_whitespaces?(mount_line)
+    ws = mount_line.match(/^(.+)\son\s(.+)\stype\s.*$/)
+    ws.captures[0].include?(' ') or ws.captures[1].include?(' ')
+  end
 end
 
 module BsdMountParser
@@ -199,7 +217,7 @@ module XinetdParser
     return [] if dir.nil?
 
     unless inspec.file(dir).directory?
-      return skip_resource "Cannot read folder in #{dir}"
+      raise Inspec::Exceptions::ResourceSkipped, "Can't find folder: #{dir}"
     end
 
     files = inspec.command("find #{dir} -type f").stdout.split("\n")
@@ -211,7 +229,7 @@ module XinetdParser
     res = {}
     cur_group = nil
     simple_conf = []
-    rest = raw
+    rest = raw + "\n"
     until rest.empty?
       # extract content line
       nl = rest.index("\n") || (rest.length-1)

metadata

@@ -1,35 +1,35 @@
 --- !ruby/object:Gem::Specification
 name: inspec
 version: !ruby/object:Gem::Version
-  version: 1.31.0
+  version: 1.45.9
 platform: ruby
 authors:
 - Dominik Richter
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-07-06 00:00:00.000000000 Z
+date: 2017-11-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: train
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.24.0
-    - - "<"
+        version: '0.29'
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: 0.29.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.24.0
-    - - "<"
+        version: '0.29'
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: 0.29.1
 - !ruby/object:Gem::Dependency
   name: thor
   requirement: !ruby/object:Gem::Requirement
@@ -219,19 +219,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 0.9.0
 - !ruby/object:Gem::Dependency
-  name: toml
+  name: tomlrb
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: '1.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: '1.2'
 - !ruby/object:Gem::Dependency
   name: addressable
   requirement: !ruby/object:Gem::Requirement
@@ -310,7 +310,6 @@ files:
 - bin/inspec
 - docs/.gitignore
 - docs/README.md
-- docs/cli.md
 - docs/dsl_inspec.md
 - docs/dsl_resource.md
 - docs/habitat.md
@@ -319,9 +318,11 @@ files:
 - docs/migration.md
 - docs/plugin_kitchen_inspec.md
 - docs/profiles.md
+- docs/resources/aide_conf.md.erb
 - docs/resources/apache_conf.md.erb
 - docs/resources/apt.md.erb
 - docs/resources/audit_policy.md.erb
+- docs/resources/auditd.md.erb
 - docs/resources/auditd_conf.md.erb
 - docs/resources/auditd_rules.md.erb
 - docs/resources/bash.md.erb
@@ -329,6 +330,8 @@ files:
 - docs/resources/bridge.md.erb
 - docs/resources/bsd_service.md.erb
 - docs/resources/command.md.erb
+- docs/resources/cpan.md.erb
+- docs/resources/cran.md.erb
 - docs/resources/crontab.md.erb
 - docs/resources/csv.md.erb
 - docs/resources/dh_params.md
@@ -336,10 +339,14 @@ files:
 - docs/resources/docker.md.erb
 - docs/resources/docker_container.md.erb
 - docs/resources/docker_image.md.erb
+- docs/resources/elasticsearch.md.erb
+- docs/resources/etc_fstab.md.erb
 - docs/resources/etc_group.md.erb
-- docs/resources/etc_passwd.md.erb
-- docs/resources/etc_shadow.md.erb
+- docs/resources/etc_hosts.md.erb
+- docs/resources/etc_hosts_allow.md.erb
+- docs/resources/etc_hosts_deny.md.erb
 - docs/resources/file.md.erb
+- docs/resources/firewalld.md.erb
 - docs/resources/gem.md.erb
 - docs/resources/group.md.erb
 - docs/resources/grub_conf.md.erb
@@ -362,6 +369,8 @@ files:
 - docs/resources/mssql_session.md.erb
 - docs/resources/mysql_conf.md.erb
 - docs/resources/mysql_session.md.erb
+- docs/resources/nginx.md.erb
+- docs/resources/nginx_conf.md.erb
 - docs/resources/npm.md.erb
 - docs/resources/ntp_conf.md.erb
 - docs/resources/oneget.md.erb
@@ -371,6 +380,7 @@ files:
 - docs/resources/package.md.erb
 - docs/resources/parse_config.md.erb
 - docs/resources/parse_config_file.md.erb
+- docs/resources/passwd.md.erb
 - docs/resources/pip.md.erb
 - docs/resources/port.md.erb
 - docs/resources/postgres_conf.md.erb
@@ -384,6 +394,7 @@ files:
 - docs/resources/runit_service.md.erb
 - docs/resources/security_policy.md.erb
 - docs/resources/service.md.erb
+- docs/resources/shadow.md.erb
 - docs/resources/ssh_config.md.erb
 - docs/resources/sshd_config.md.erb
 - docs/resources/ssl.md.erb
@@ -396,10 +407,12 @@ files:
 - docs/resources/vbscript.md.erb
 - docs/resources/virtualization.md.erb
 - docs/resources/windows_feature.md.erb
+- docs/resources/windows_hotfix.md.erb
 - docs/resources/windows_task.md.erb
 - docs/resources/wmi.md.erb
 - docs/resources/x509_certificate.md.erb
 - docs/resources/xinetd_conf.md.erb
+- docs/resources/xml.md.erb
 - docs/resources/yaml.md.erb
 - docs/resources/yum.md.erb
 - docs/resources/zfs_dataset.md.erb
@@ -444,6 +457,10 @@ files:
 - examples/profile-attribute/README.md
 - examples/profile-attribute/controls/example.rb
 - examples/profile-attribute/inspec.yml
+- examples/profile-sensitive/README.md
+- examples/profile-sensitive/controls/sensitive-failures.rb
+- examples/profile-sensitive/controls/sensitive.rb
+- examples/profile-sensitive/inspec.yml
 - examples/profile/README.md
 - examples/profile/controls/example.rb
 - examples/profile/controls/gordon.rb
@@ -459,6 +476,7 @@ files:
 - lib/bundles/inspec-compliance/.kitchen.yml
 - lib/bundles/inspec-compliance/README.md
 - lib/bundles/inspec-compliance/api.rb
+- lib/bundles/inspec-compliance/api/login.rb
 - lib/bundles/inspec-compliance/bootstrap.sh
 - lib/bundles/inspec-compliance/cli.rb
 - lib/bundles/inspec-compliance/configuration.rb
@@ -552,16 +570,20 @@ files:
 - lib/inspec/source_reader.rb
 - lib/inspec/version.rb
 - lib/matchers/matchers.rb
+- lib/resources/aide_conf.rb
 - lib/resources/apache.rb
 - lib/resources/apache_conf.rb
 - lib/resources/apt.rb
 - lib/resources/audit_policy.rb
+- lib/resources/auditd.rb
 - lib/resources/auditd_conf.rb
 - lib/resources/auditd_rules.rb
 - lib/resources/bash.rb
 - lib/resources/bond.rb
 - lib/resources/bridge.rb
 - lib/resources/command.rb
+- lib/resources/cpan.rb
+- lib/resources/cran.rb
 - lib/resources/crontab.rb
 - lib/resources/csv.rb
 - lib/resources/dh_params.rb
@@ -569,8 +591,13 @@ files:
 - lib/resources/docker.rb
 - lib/resources/docker_container.rb
 - lib/resources/docker_image.rb
+- lib/resources/elasticsearch.rb
+- lib/resources/etc_fstab.rb
 - lib/resources/etc_group.rb
+- lib/resources/etc_hosts.rb
+- lib/resources/etc_hosts_allow_deny.rb
 - lib/resources/file.rb
+- lib/resources/firewalld.rb
 - lib/resources/gem.rb
 - lib/resources/groups.rb
 - lib/resources/grub_conf.rb
@@ -593,6 +620,7 @@ files:
 - lib/resources/mysql.rb
 - lib/resources/mysql_conf.rb
 - lib/resources/mysql_session.rb
+- lib/resources/nginx.rb
 - lib/resources/nginx_conf.rb
 - lib/resources/npm.rb
 - lib/resources/ntp_conf.rb
@@ -626,10 +654,12 @@ files:
 - lib/resources/vbscript.rb
 - lib/resources/virtualization.rb
 - lib/resources/windows_feature.rb
+- lib/resources/windows_hotfix.rb
 - lib/resources/windows_task.rb
 - lib/resources/wmi.rb
 - lib/resources/x509_certificate.rb
 - lib/resources/xinetd.rb
+- lib/resources/xml.rb
 - lib/resources/yaml.rb
 - lib/resources/yum.rb
 - lib/resources/zfs_dataset.rb
@@ -666,7 +696,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.1'
+      version: '2.3'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
@@ -674,7 +704,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.11
+rubygems_version: 2.6.14
 signing_key: 
 specification_version: 4
 summary: Infrastructure and compliance testing.