inspec 4.18.51 → 4.18.85

data/lib/inspec/fetcher/mock.rb

@@ -1,34 +0,0 @@
-require "inspec/fetcher"
-
-module Inspec::Fetcher
-  class Mock < Inspec.fetcher(1)
-    name "mock"
-    priority 0
-
-    def self.resolve(target)
-      return nil unless target.is_a? Hash
-
-      new(target)
-    end
-
-    def initialize(data)
-      @data = data
-    end
-
-    def fetch(_path)
-      archive_path
-    end
-
-    def archive_path
-      { mock: @data }
-    end
-
-    def resolved_source
-      { mock_fetcher: true }
-    end
-
-    def cache_key
-      ""
-    end
-  end
-end

data/lib/inspec/fetcher/url.rb

@@ -1,281 +0,0 @@
-require "uri"
-require "openssl"
-require "tempfile"
-require "open-uri"
-
-module Inspec::Fetcher
-  class Url < Inspec.fetcher(1)
-    MIME_TYPES = {
-      "application/x-zip-compressed" => ".zip",
-      "application/zip" => ".zip",
-      "application/x-gzip" => ".tar.gz",
-      "application/gzip" => ".tar.gz",
-    }.freeze
-
-    name "url"
-    priority 200
-
-    def self.resolve(target, opts = {})
-      if target.is_a?(Hash) && target.key?(:url)
-        resolve_from_string(target[:url], opts, target[:username], target[:password])
-      elsif target.is_a?(String)
-        resolve_from_string(target, opts)
-      elsif target.is_a?(URI)
-        resolve_from_string(target.to_s, opts)
-      end
-    end
-
-    def self.resolve_from_string(target, opts, username = nil, password = nil)
-      uri = URI.parse(target)
-      return nil if uri.nil? || uri.scheme.nil?
-      return nil unless %{ http https }.include? uri.scheme
-
-      target = transform(target)
-      opts[:username] = username if username
-      opts[:password] = password if password
-      new(target, opts)
-    rescue URI::Error
-      nil
-    end
-
-    # Transforms a browser github/bitbucket url to github/bitbucket tar url
-    # We distinguish between three different Github/Bitbucket URL types:
-    #  - Master URL
-    #  - Branch URL
-    #  - Commit URL
-    #
-    # master url:
-    # https://github.com/nathenharvey/tmp_compliance_profile/ is transformed to
-    # https://github.com/nathenharvey/tmp_compliance_profile/archive/master.tar.gz
-    # https://bitbucket.org/username/repo is transformed to
-    # https://bitbucket.org/username/repo/get/master.tar.gz
-    #
-    # branch:
-    # https://github.com/hardening-io/tests-os-hardening/tree/2.0 is transformed to
-    # https://github.com/hardening-io/tests-os-hardening/archive/2.0.tar.gz
-    # https://bitbucket.org/username/repo/branch/branchname is transformed to
-    # https://bitbucket.org/username/repo/get/newbranch.tar.gz
-    #
-    # commit:
-    # https://github.com/hardening-io/tests-os-hardening/tree/48bd4388ddffde68badd83aefa654e7af3231876
-    # is transformed to
-    # https://github.com/hardening-io/tests-os-hardening/archive/48bd4388ddffde68badd83aefa654e7af3231876.tar.gz
-    # https://bitbucket.org/username/repo/commits/95ce1f83d5bbe9eec34c5973f6894617e8d6d8cc is transformed to
-    # https://bitbucket.org/username/repo/get/95ce1f83d5bbe9eec34c5973f6894617e8d6d8cc.tar.gz
-
-    GITHUB_URL_REGEX = %r{^https?://(www\.)?github\.com/(?<user>[\w-]+)/(?<repo>[\w.-]+?)(\.git)?(/)?$}.freeze
-    GITHUB_URL_WITH_TREE_REGEX = %r{^https?://(www\.)?github\.com/(?<user>[\w-]+)/(?<repo>[\w.-]+)/tree/(?<commit>[\w\.]+)(/)?$}.freeze
-    BITBUCKET_URL_REGEX = %r{^https?://(www\.)?bitbucket\.org/(?<user>[\w-]+)/(?<repo>[\w-]+)(\.git)?(/)?$}.freeze
-    BITBUCKET_URL_BRANCH_REGEX = %r{^https?://(www\.)?bitbucket\.org/(?<user>[\w-]+)/(?<repo>[\w-]+)/branch/(?<branch>[\w\.]+)(/)?$}.freeze
-    BITBUCKET_URL_COMMIT_REGEX = %r{^https?://(www\.)?bitbucket\.org/(?<user>[\w-]+)/(?<repo>[\w-]+)/commits/(?<commit>[\w\.]+)(/)?$}.freeze
-
-    def self.transform(target)
-      transformed_target = if m = GITHUB_URL_REGEX.match(target) # rubocop:disable Lint/AssignmentInCondition
-                             "https://github.com/#{m[:user]}/#{m[:repo]}/archive/master.tar.gz"
-                           elsif m = GITHUB_URL_WITH_TREE_REGEX.match(target) # rubocop:disable Lint/AssignmentInCondition
-                             "https://github.com/#{m[:user]}/#{m[:repo]}/archive/#{m[:commit]}.tar.gz"
-                           elsif m = BITBUCKET_URL_REGEX.match(target) # rubocop:disable Lint/AssignmentInCondition
-                             "https://bitbucket.org/#{m[:user]}/#{m[:repo]}/get/master.tar.gz"
-                           elsif m = BITBUCKET_URL_BRANCH_REGEX.match(target) # rubocop:disable Lint/AssignmentInCondition
-                             "https://bitbucket.org/#{m[:user]}/#{m[:repo]}/get/#{m[:branch]}.tar.gz"
-                           elsif m = BITBUCKET_URL_COMMIT_REGEX.match(target) # rubocop:disable Lint/AssignmentInCondition
-                             "https://bitbucket.org/#{m[:user]}/#{m[:repo]}/get/#{m[:commit]}.tar.gz"
-                           end
-
-      if transformed_target
-        Inspec::Log.warn("URL target #{target} transformed to #{transformed_target}. Consider using the git fetcher")
-        transformed_target
-      else
-        target
-      end
-    end
-
-    attr_reader :files, :archive_path
-
-    def initialize(url, opts)
-      @target = url.to_s
-      @target_uri = url.is_a?(URI) ? url : parse_uri(url)
-      @insecure = opts["insecure"]
-      @token = opts["token"]
-      @config = opts
-      @archive_path = nil
-      @temp_archive_path = nil
-    end
-
-    def fetch(path)
-      @archive_path ||= download_archive(path)
-    end
-
-    def resolved_source
-      @resolved_source ||= { url: @target, sha256: sha256 }
-    end
-
-    def cache_key
-      @archive_shasum ||= sha256
-    end
-
-    def to_s
-      @target
-    end
-
-    private
-
-    def parse_uri(target)
-      return URI.parse(target) if target.is_a?(String)
-
-      URI.parse(target[:url])
-    end
-
-    def sha256
-      file = @archive_path || temp_archive_path
-      OpenSSL::Digest::SHA256.digest(File.read(file)).unpack("H*")[0]
-    end
-
-    def file_type_from_remote(remote)
-      content_type = remote.meta["content-type"]
-      file_type = MIME_TYPES[content_type]
-
-      if file_type.nil?
-        Inspec::Log.warn("Unrecognized content type: #{content_type}. Assuming tar.gz")
-        file_type = ".tar.gz"
-      end
-
-      file_type
-    end
-
-    def temp_archive_path
-      @temp_archive_path ||= if @config["server_type"] == "automate2"
-                               download_automate2_archive_to_temp
-                             else
-                               download_archive_to_temp
-                             end
-    end
-
-    def download_automate2_archive_to_temp
-      return @temp_archive_path unless @temp_archive_path.nil?
-
-      Inspec::Log.debug("Fetching URL: #{@target}")
-      json = {
-        owner: @config["profile"][0],
-        name: @config["profile"][1],
-        version: @config["profile"][2],
-      }.to_json
-
-      opts = http_opts
-      opts[:use_ssl] = @target_uri.scheme == "https"
-
-      if @insecure
-        opts[:verify_mode] = OpenSSL::SSL::VERIFY_NONE
-      else
-        opts[:verify_mode] = OpenSSL::SSL::VERIFY_PEER
-      end
-
-      req = Net::HTTP::Post.new(@target_uri)
-      opts.each do |key, value|
-        req.add_field(key, value)
-      end
-      req.body = json
-      res = Net::HTTP.start(@target_uri.host, @target_uri.port, opts) do |http|
-        http.request(req)
-      end
-
-      @archive_type = ".tar.gz"
-      archive = Tempfile.new(["inspec-dl-", @archive_type])
-      archive.binmode
-      archive.write(res.body)
-      archive.rewind
-      archive.close
-      Inspec::Log.debug("Archive stored at temporary location: #{archive.path}")
-      @temp_archive_path = archive.path
-    end
-
-    # Downloads archive to temporary file with side effect :( of setting @archive_type
-    def download_archive_to_temp
-      return @temp_archive_path unless @temp_archive_path.nil?
-
-      Inspec::Log.debug("Fetching URL: #{@target}")
-      remote = open_via_uri(@target)
-      @archive_type = file_type_from_remote(remote) # side effect :(
-      archive = Tempfile.new(["inspec-dl-", @archive_type])
-      archive.binmode
-      archive.write(remote.read)
-      archive.rewind
-      archive.close
-      Inspec::Log.debug("Archive stored at temporary location: #{archive.path}")
-      @temp_archive_path = archive.path
-    end
-
-    def open(target, opts) # overridden so we can control who we're talking to
-      URI.open(target, opts)
-    rescue NoMethodError   # TODO: remove when we drop ruby 2.4
-      super(target, opts)  # Kernel#open
-    end
-
-    def open_via_uri(target)
-      opts = http_opts
-
-      # OpenURI does not support userinfo so we need to remove it
-      # https://ruby-doc.org/stdlib-2.5.0/libdoc/open-uri/rdoc/OpenURI/OpenRead.html#method-i-open
-      target = target.sub("#{@target_uri.userinfo}@", "") if
-        opts[:http_basic_authentication]
-
-      open(target, opts)
-
-    rescue SocketError, Errno::ECONNREFUSED, OpenURI::HTTPError => e
-      raise Inspec::FetcherFailure, "Profile URL dependency #{target} could not be fetched: #{e.message}"
-    end
-
-    def download_archive(path)
-      temp_archive_path
-      final_path = "#{path}#{@archive_type}"
-      FileUtils.mkdir_p(File.dirname(final_path))
-      FileUtils.mv(temp_archive_path, final_path)
-      Inspec::Log.debug("Fetched archive moved to: #{final_path}")
-      @temp_archive_path = nil
-      final_path
-    end
-
-    def http_opts
-      opts = {}
-      opts[:ssl_verify_mode] = OpenSSL::SSL::VERIFY_NONE if @insecure
-
-      if @config["server_type"] =~ /automate/
-        opts["chef-delivery-enterprise"] = @config["automate"]["ent"]
-        if @config["automate"]["token_type"] == "dctoken"
-          opts["x-data-collector-token"] = @config["token"]
-        else
-          opts["chef-delivery-user"] = @config["user"]
-          opts["chef-delivery-token"] = @config["token"]
-        end
-      elsif @token
-        opts["Authorization"] = "Bearer #{@token}"
-      end
-
-      username = @config[:username] || @target_uri.user
-      password = @config[:password] || @target_uri.password
-      opts[:http_basic_authentication] = [username, password] if username
-
-      # Do not send any headers that have nil values.
-      # Net::HTTP does not gracefully handle this situation.
-      check_for_missing_values!(opts)
-
-      opts
-    end
-
-    def check_for_missing_values!(opts)
-      keys_missing_values = opts.keys.delete_if do |k|
-        if opts[k].nil?
-          false
-        elsif opts[k].respond_to?(:empty?) && opts[k].empty?
-          false
-        else
-          true
-        end
-      end
-      unless keys_missing_values.empty?
-        raise Inspec::FetcherFailure, "Unable to fetch profile - the following HTTP headers have no value: " \
-          "#{keys_missing_values.join(", ")}"
-      end
-    end
-  end
-end

data/lib/inspec/file_provider.rb

@@ -1,318 +0,0 @@
-require "rubygems/package"
-require "pathname"
-require "zlib"
-require "zip"
-
-module Inspec
-  class FileProvider
-    def self.for_path(path)
-      if path.is_a?(Hash)
-        MockProvider.new(path)
-      elsif File.directory?(path)
-        DirProvider.new(path)
-      elsif File.exist?(path) && path.end_with?(".tar.gz", "tgz")
-        TarProvider.new(path)
-      elsif File.exist?(path) && path.end_with?(".zip")
-        ZipProvider.new(path)
-      elsif File.exist?(path)
-        DirProvider.new(path)
-      else
-        raise "No file provider for the provided path: #{path}"
-      end
-    end
-
-    def initialize(_path); end
-
-    # List all files that are offered.
-    #
-    # @return [Array[String]] list of file paths that are included
-    def files
-      raise "Fetcher #{self} does not implement `files()`. This is required."
-    end
-
-    # Read the contents of a file. This will typically refer to a text
-    # file reading a string.
-    #
-    # @param _file [String] path of the file to be read
-    # @return [String] contents of the file described
-    def read(_file)
-      raise "#{self} does not implement `read(...)`. This is required."
-    end
-
-    # Provide a method for reading binary contents from a file.
-    # It will default to #read if not defined. For most streams that implement
-    # it, it will be the same. For some special cases, it will add change the
-    # way in which encoding of the returned data structure is handled.
-    # Does not work with alias nor alias_method.
-    def binread(file)
-      read(file)
-    end
-
-    def relative_provider
-      RelativeFileProvider.new(self)
-    end
-  end # class FileProvider
-
-  class MockProvider < FileProvider
-    attr_reader :files
-    def initialize(path)
-      @data = path[:mock]
-      @files = @data.keys
-    end
-
-    def read(file)
-      @data[file]
-    end
-  end
-
-  class DirProvider < FileProvider
-    attr_reader :files
-    def initialize(path)
-      @files = if File.file?(path)
-                 [path]
-               else
-                 Dir[File.join(Shellwords.shellescape(path), "**", "*")]
-               end
-      @path = path
-    end
-
-    def read(file)
-      return nil unless files.include?(file)
-      return nil unless File.file?(file)
-
-      File.read(file)
-    end
-
-    def binread(file)
-      return nil unless files.include?(file)
-      return nil unless File.file?(file)
-
-      File.binread(file)
-    end
-  end # class DirProvider
-
-  class ZipProvider < FileProvider
-    attr_reader :files
-
-    def initialize(path)
-      @path = path
-      @contents = {}
-      @files = []
-      walk_zip(@path) do |io|
-        while (entry = io.get_next_entry)
-          name = entry.name.sub(%r{/+$}, "")
-          @files.push(name) unless name.empty? || name.squeeze("/") =~ %r{\.{2}(?:/|\z)}
-        end
-      end
-    end
-
-    def extract(destination_path = ".")
-      FileUtils.mkdir_p(destination_path)
-
-      Zip::File.open(@path) do |archive|
-        archive.each do |file|
-          final_path = File.join(destination_path, file.name)
-
-          # This removes the top level directory (and any other files) to ensure
-          # extracted files do not conflict.
-          FileUtils.remove_entry(final_path) if File.exist?(final_path)
-
-          archive.extract(file, final_path)
-        end
-      end
-    end
-
-    def read(file)
-      # TODO: this is inefficient
-      @contents[file] ||= read_from_zip(file)
-    end
-
-    private
-
-    def walk_zip(path, &callback)
-      ::Zip::InputStream.open(path, &callback)
-    end
-
-    def read_from_zip(file)
-      return nil unless @files.include?(file)
-
-      res = nil
-      walk_zip(@path) do |io|
-        while (entry = io.get_next_entry)
-          next unless file == entry.name
-
-          res = io.read
-          try = res.dup
-          try.force_encoding Encoding::UTF_8
-          res = try.encode(try.encoding, universal_newline: true) if try.valid_encoding?
-
-          break
-        end
-      end
-      res
-    end
-  end # class ZipProvider
-
-  class TarProvider < FileProvider
-    attr_reader :files
-
-    def initialize(path)
-      @path = path
-      @contents = {}
-
-      here = Pathname.new(".")
-
-      walk_tar(@path) do |entries|
-        entries.each do |entry|
-          name = entry.full_name
-
-          # rubocop:disable Layout/MultilineOperationIndentation
-          # rubocop:disable Style/ParenthesesAroundCondition
-          next unless (entry.file? &&              # duh
-                       !name.empty? &&             # for empty filenames?
-                       name !~ %r{\.\.(?:/|\z)} && # .. (to avoid attacks?)
-                       !name.include?("PaxHeader/"))
-
-          path = Pathname.new(name).relative_path_from(here).to_s
-
-          @contents[path] = begin # not ||= in a tarball, last one wins
-                              res = entry.read || ""
-                              try = res.dup
-                              try.force_encoding Encoding::UTF_8
-                              res = try.encode(try.encoding, universal_newline: true) if
-                                try.valid_encoding?
-                              res
-                            end
-        end
-
-        @files = @contents.keys
-      end
-    end
-
-    def extract(destination_path = ".")
-      FileUtils.mkdir_p(destination_path)
-
-      @contents.each do |path, body|
-        full_path = File.join(destination_path, path)
-
-        FileUtils.mkdir_p(File.dirname(full_path))
-        File.open(full_path, "wb") { |f| f.write(body) }
-      end
-    end
-
-    def read(file)
-      @contents[file]
-    end
-
-    private
-
-    def walk_tar(path, &callback)
-      tar_file = Zlib::GzipReader.open(path)
-      Gem::Package::TarReader.new(tar_file, &callback)
-    ensure
-      tar_file.close
-    end
-  end # class TarProvider
-
-  class RelativeFileProvider
-    BLACKLIST_FILES = [
-      "/pax_global_header",
-      "pax_global_header",
-    ].freeze
-
-    attr_reader :files
-    attr_reader :prefix
-    attr_reader :parent
-
-    def initialize(parent_provider)
-      @parent = parent_provider
-      @prefix = get_prefix(parent.files)
-      if @prefix.nil?
-        raise "Could not determine path prefix for #{parent}"
-      end
-
-      # select all files that begin with the prefix, and strip off the prefix from the file.
-      #
-      # strip off any leading top-level relative path (./) which is common in
-      # PAX-formatted tar files. Do not do any translation of the path if the
-      # path is an absolute path.
-      @files = parent.files
-        .find_all { |x| x.start_with?(prefix) && x != prefix }
-        .map { |x| x[prefix.length..-1] }
-        .map do |x|
-          path = Pathname.new(x)
-          path.absolute? ? path.to_s : path.relative_path_from(Pathname.new(".")).to_s
-        end
-    end
-
-    def abs_path(file)
-      return nil if file.nil?
-
-      prefix + file
-    end
-
-    def read(file)
-      parent.read(abs_path(file))
-    end
-
-    def binread(file)
-      parent.binread(abs_path(file))
-    end
-
-    private
-
-    def get_prefix(fs)
-      return "" if fs.empty?
-
-      # filter backlisted files
-      fs -= BLACKLIST_FILES
-
-      sorted = fs.sort_by(&:length)
-      get_folder_prefix(sorted)
-    end
-
-    def prefix_candidate_for(file)
-      if file.end_with?(File::SEPARATOR)
-        file
-      else
-        file + File::SEPARATOR
-      end
-    end
-
-    def get_folder_prefix(fs)
-      return get_files_prefix(fs) if fs.length == 1
-
-      first, *rest = fs
-      pre = prefix_candidate_for(first)
-
-      if rest.all? { |i| i.start_with? pre }
-        return get_folder_prefix(rest)
-      end
-
-      get_files_prefix(fs)
-    end
-
-    def get_files_prefix(fs)
-      return "" if fs.empty?
-
-      file = fs[0]
-      bn = File.basename(file)
-      # no more prefixes
-      return "" if bn == file
-
-      i = file.rindex(bn)
-      pre = file[0..i - 1]
-
-      rest = fs.find_all { |f| !f.start_with?(pre) }
-      return pre if rest.empty?
-
-      new_pre = get_prefix(rest)
-      return new_pre if pre.start_with? new_pre
-
-      # edge case: completely different prefixes; retry prefix detection
-      a = File.dirname(pre + "a")
-      b = File.dirname(new_pre + "b")
-      get_prefix([a, b])
-    end
-  end # class RelativeFileProvider
-end