inspec 4.18.51 → 4.18.85

data/lib/inspec/resources/mysql_session.rb

@@ -1,88 +0,0 @@
-# copyright: 2015, Vulcano Security GmbH
-
-require "inspec/resources/command"
-require "shellwords"
-
-module Inspec::Resources
-  class MysqlSession < Inspec.resource(1)
-    name "mysql_session"
-    supports platform: "unix"
-    supports platform: "windows"
-    desc "Use the mysql_session InSpec audit resource to test SQL commands run against a MySQL database."
-    example <<~EXAMPLE
-      sql = mysql_session('my_user','password','host')
-      describe sql.query('show databases like \'test\';') do
-        its('stdout') { should_not match(/test/) }
-      end
-    EXAMPLE
-
-    def initialize(user = nil, pass = nil, host = "localhost", port = nil, socket = nil)
-      @user = user
-      @pass = pass
-      @host = host
-      @port = port
-      @socket = socket
-      init_fallback if user.nil? || pass.nil?
-      skip_resource("Can't run MySQL SQL checks without authentication") if @user.nil? || @pass.nil?
-    end
-
-    def query(q, db = "")
-      mysql_cmd = create_mysql_cmd(q, db)
-      cmd = inspec.command(mysql_cmd)
-      out = cmd.stdout + "\n" + cmd.stderr
-      if out =~ /Can't connect to .* MySQL server/ || out.downcase =~ /^error /
-        # skip this test if the server can't run the query
-        warn("Can't connect to MySQL instance for SQL checks.")
-      end
-
-      # return the raw command output
-      cmd
-    end
-
-    def to_s
-      "MySQL Session"
-    end
-
-    private
-
-    def escape_string(query)
-      Shellwords.escape(query)
-    end
-
-    def create_mysql_cmd(q, db = "")
-      # TODO: simple escape, must be handled by a library
-      # that does this securely
-      escaped_query = q.gsub(/\\/, '\\\\').gsub(/"/, '\\"').gsub(/\$/, '\\$')
-
-      # construct the query
-      command = "mysql"
-      command += " -u#{escape_string(@user)}" unless @user.nil?
-      command += " -p#{escape_string(@pass)}" unless @pass.nil?
-
-      if !@socket.nil?
-        command += " -S #{@socket}"
-      else
-        command += " -h #{@host}"
-      end
-      command += " --port #{@port}" unless @port.nil?
-      command += " #{db}" unless db.empty?
-      command += %{ -s -e "#{escaped_query}"}
-      command
-    end
-
-    def init_fallback
-      # support debian mysql administration login
-      return if inspec.platform.in_family?("windows")
-
-      debian = inspec.command("test -f /etc/mysql/debian.cnf && cat /etc/mysql/debian.cnf").stdout
-      return if debian.empty?
-
-      user = debian.match(/^\s*user\s*=\s*([^ ]*)\s*$/)
-      pass = debian.match(/^\s*password\s*=\s*([^ ]*)\s*$/)
-      return if user.nil? || pass.nil?
-
-      @user = user[1]
-      @pass = pass[1]
-    end
-  end
-end

data/lib/inspec/resources/nginx.rb

@@ -1,96 +0,0 @@
-require "pathname"
-require "hashie/mash"
-require "inspec/resources/command"
-
-module Inspec::Resources
-  class Nginx < Inspec.resource(1)
-    name "nginx"
-    supports platform: "unix"
-    desc "Use the nginx InSpec audit resource to test information about your NGINX instance."
-    example <<~EXAMPLE
-      describe nginx do
-        its('conf_path') { should cmp '/etc/nginx/nginx.conf' }
-      end
-      describe nginx('/etc/sbin/') do
-        its('version') { should be >= '1.0.0' }
-      end
-      describe nginx do
-        its('modules') { should include 'my_module' }
-      end
-    EXAMPLE
-    attr_reader :params, :bin_dir
-
-    def initialize(nginx_path = "/usr/sbin/nginx")
-      return skip_resource "The `nginx` resource is not yet available on your OS." if inspec.os.windows?
-      return skip_resource "The `nginx` binary not found in the path provided." unless inspec.command(nginx_path).exist?
-
-      cmd = inspec.command("#{nginx_path} -V 2>&1")
-      if cmd.exit_status != 0
-        return skip_resource "Error using the command nginx -V"
-      end
-
-      @data = cmd.stdout
-      @params = {}
-      read_content
-    end
-
-    %w{error_log_path http_client_body_temp_path http_fastcgi_temp_path http_log_path http_proxy_temp_path http_scgi_temp_path http_uwsgi_temp_path lock_path modules_path prefix sbin_path service version}.each do |property|
-      define_method(property.to_sym) do
-        @params[property.to_sym]
-      end
-    end
-
-    def openssl_version
-      result = @data.scan(/built with OpenSSL\s(\S+)\s(\d+\s\S+\s\d{4})/).flatten
-      Hashie::Mash.new({ "version" => result[0], "date" => result[1] })
-    end
-
-    def compiler_info
-      result = @data.scan(/built by (\S+)\s(\S+)\s(\S+)/).flatten
-      Hashie::Mash.new({ "compiler" => result[0], "version" => result[1], "date" => result[2] })
-    end
-
-    def support_info
-      support_info = @data.scan(/(.*\S+) support enabled/).flatten
-      support_info.empty? ? nil : support_info.join(" ")
-    end
-
-    def modules
-      @data.scan(/--with-(\S+)_module/).flatten
-    end
-
-    def to_s
-      "Nginx Environment"
-    end
-
-    private
-
-    def read_content
-      parse_config
-      parse_path
-      parse_http_path
-    end
-
-    def parse_config
-      @params[:prefix] = @data.scan(/--prefix=(\S+)\s/).flatten.first
-      @params[:service] = "nginx"
-      @params[:version] = @data.scan(%r{nginx version: nginx\/(\S+)\s}).flatten.first
-    end
-
-    def parse_path
-      @params[:sbin_path] = @data.scan(/--sbin-path=(\S+)\s/).flatten.first
-      @params[:modules_path] = @data.scan(/--modules-path=(\S+)\s/).flatten.first
-      @params[:error_log_path] = @data.scan(/--error-log-path=(\S+)\s/).flatten.first
-      @params[:http_log_path] = @data.scan(/--http-log-path=(\S+)\s/).flatten.first
-      @params[:lock_path] = @data.scan(/--lock-path=(\S+)\s/).flatten.first
-    end
-
-    def parse_http_path
-      @params[:http_client_body_temp_path] = @data.scan(/--http-client-body-temp-path=(\S+)\s/).flatten.first
-      @params[:http_proxy_temp_path] = @data.scan(/--http-proxy-temp-path=(\S+)\s/).flatten.first
-      @params[:http_fastcgi_temp_path] = @data.scan(/--http-fastcgi-temp-path=(\S+)\s/).flatten.first
-      @params[:http_uwsgi_temp_path] = @data.scan(/--http-uwsgi-temp-path=(\S+)\s/).flatten.first
-      @params[:http_scgi_temp_path] = @data.scan(/--http-scgi-temp-path=(\S+)\s/).flatten.first
-    end
-  end
-end

data/lib/inspec/resources/nginx_conf.rb

@@ -1,232 +0,0 @@
-require "inspec/utils/nginx_parser"
-require "inspec/utils/find_files"
-require "inspec/utils/file_reader"
-require "forwardable"
-
-# STABILITY: Experimental
-# This resouce needs a proper interace to the underlying data, which is currently missing.
-# Until it is added, we will keep it experimental.
-#
-# TODO: Support it on Windows. To do so, we need to recognize the base os and how
-# it combines the file path. Calling `File.join` or similar methods may lead to errors
-# when running remotely.
-module Inspec::Resources
-  class NginxConf < Inspec.resource(1)
-    name "nginx_conf"
-    supports platform: "unix"
-    desc "Use the nginx_conf InSpec resource to test configuration data "\
-         "for the NginX web server located in /etc/nginx/nginx.conf on "\
-         "Linux and UNIX platforms."
-    example <<~EXAMPLE
-      describe nginx_conf.params ...
-      describe nginx_conf('/path/to/my/nginx.conf').params ...
-    EXAMPLE
-
-    extend Forwardable
-
-    include FindFiles
-    include FileReader
-
-    attr_reader :contents
-
-    def initialize(conf_path = nil)
-      @conf_path = conf_path || "/etc/nginx/nginx.conf"
-      @contents = {}
-      return skip_resource "The `nginx_conf` resource is currently not supported on Windows." if inspec.os.windows?
-
-      read_content(@conf_path)
-    end
-
-    def params
-      @params ||= parse_nginx(@conf_path)
-    rescue StandardError => e
-      skip_resource e.message
-      @params = {}
-    end
-
-    def http
-      NginxConfHttp.new(params["http"], self)
-    end
-
-    def_delegators :http, :servers, :locations
-
-    def to_s
-      "nginx_conf #{@conf_path}"
-    end
-
-    private
-
-    def read_content(path)
-      return @contents[path] if @contents.key?(path)
-
-      @contents[path] = read_file_content(path, allow_empty: true)
-    end
-
-    def parse_nginx(path)
-      return nil if inspec.os.windows?
-
-      content = read_content(path)
-
-      # Don't attempt to parse file if it contains only comments or is empty
-      # https://regexper.com/#%2F%5E%5Cs*%23%7C%5E%24%2F
-      return {} if content.lines.reject { |l| l =~ /^\s*#|^$/ }.empty?
-
-      data = NginxConfig.parse(content)
-      resolve_references(data, File.dirname(path))
-    rescue StandardError => _
-      raise "Cannot parse NginX config in #{path}."
-    end
-
-    # Cycle through the complete parsed data structure and try to find any
-    # calls to `include`. In NginX, this is used to embed data from other
-    # files into the current data structure.
-    #
-    # The method steps through the object structure that is passed in to
-    # find any calls to 'include' and returns the object structure with the
-    # included data merged in.
-    #
-    # @param data [Hash] data structure from NginxConfig.parse
-    # @param rel_path [String] the relative path from which this config is read
-    # @return [Hash] data structure with references included
-    def resolve_references(data, rel_path)
-      # Walk through all array entries to find more references
-      return data.map { |x| resolve_references(x, rel_path) } if data.is_a?(Array)
-
-      # Return any data that we cannot step into to find more `include` calls
-      return data unless data.is_a?(Hash)
-
-      # Any call to `include` gets its data read, parsed, and merged back
-      # into the current data structure
-      if data.key?("include")
-        data.delete("include").flatten
-          .map { |x| File.expand_path(x, rel_path) }
-          .map { |x| find_files(x) }.flatten
-          .map { |path| parse_nginx(path) }
-          .each { |conf| merge_config!(data, conf) }
-      end
-
-      # Walk through the remaining hash fields to find more references
-      Hash[data.map { |k, v| [k, resolve_references(v, rel_path)] }]
-    end
-
-    # Deep merge fields from NginxConfig.parse.
-    # A regular merge would overwrite values so a deep merge is needed.
-    # @param data [Hash] data structure from NginxConfig.parse
-    # @param conf [Hash] data structure to be deep merged into data
-    # @return [Hash] data structure with conf and data deep merged
-    def merge_config!(data, conf)
-      # Catch edge-cases
-      return if data.nil? || conf.nil?
-
-      # Step through all conf items and create combined return value
-      data.merge!(conf) do |_, v1, v2|
-        if v1.is_a?(Array) && v2.is_a?(Array)
-          # If both the data field and the conf field are arrays, then combine them
-          v1 + v2
-        elsif v1.is_a?(Hash) && v2.is_a?(Hash)
-          # If both the data field and the conf field are maps, then deep merge them
-          merge_config!(v1, v2)
-        else
-          # All other cases, just use the new value (regular merge behavior)
-          v2
-        end
-      end
-    end
-  end
-
-  class NginxConfHttp
-    attr_reader :entries
-    def initialize(params, parent)
-      @parent = parent
-      @entries = (params || []).map { |x| NginxConfHttpEntry.new(x, parent) }
-    end
-
-    def servers
-      @entries.map(&:servers).flatten
-    end
-
-    def locations
-      servers.map(&:locations).flatten
-    end
-
-    def to_s
-      @parent.to_s + ", http entries"
-    end
-    alias inspect to_s
-  end
-
-  class NginxConfHttpEntry
-    attr_reader :params, :parent
-    def initialize(params, parent)
-      @params = params || {}
-      @parent = parent
-    end
-
-    filter = FilterTable.create
-    filter.register_column(:servers, field: "server")
-      .install_filter_methods_on_resource(self, :server_table)
-
-    def locations
-      servers.map(&:locations).flatten
-    end
-
-    def to_s
-      @parent.to_s + ", http entry"
-    end
-    alias inspect to_s
-
-    private
-
-    def server_table
-      @server_table ||= (params["server"] || []).map { |x| { "server" => NginxConfServer.new(x, self) } }
-    end
-  end
-
-  class NginxConfServer # TODO: rename NginxServer
-    attr_reader :params, :parent
-    def initialize(params, parent)
-      @parent = parent
-      @params = params || {}
-    end
-
-    filter = FilterTable.create
-    filter.register_column(:locations, field: "location")
-      .install_filter_methods_on_resource(self, :location_table)
-
-    def to_s
-      server = ""
-      name = Array(params["server_name"]).flatten.first
-      unless name.nil?
-        server += name
-        listen = Array(params["listen"]).flatten.first
-        server += ":#{listen}" unless listen.nil?
-      end
-
-      # go two levels up: 1. to the http entry and 2. to the root nginx conf
-      @parent.parent.to_s + ", server #{server}"
-    end
-    alias inspect to_s
-
-    private
-
-    def location_table
-      @location_table ||= (params["location"] || []).map { |x| { "location" => NginxConfLocation.new(x, self) } }
-    end
-  end
-
-  class NginxConfLocation
-    attr_reader :params, :parent
-    def initialize(params, parent)
-      @parent = parent
-      @params = params || {}
-    end
-
-    def to_s
-      location = Array(params["_"]).join(" ")
-      # go three levels up: 1. to the server entry, 2. http entry and 3. to the root nginx conf
-      # TODO: fix parent.parent.parent
-      @parent.parent.parent.to_s + ", location #{location.inspect}"
-    end
-    alias inspect to_s
-  end
-end

data/lib/inspec/resources/noop.rb

@@ -1,9 +0,0 @@
-module Inspec::Resources
-  class Noop < Inspec.resource(1)
-    name "noop"
-
-    def to_s
-      "No-op"
-    end
-  end
-end

data/lib/inspec/resources/npm.rb

@@ -1,68 +0,0 @@
-require "inspec/resources/command"
-require "shellwords"
-
-module Inspec::Resources
-  class NpmPackage < Inspec.resource(1)
-    name "npm"
-    supports platform: "unix"
-    supports platform: "windows"
-    desc "Use the npm InSpec audit resource to test if a global npm package is installed. npm is the the package manager for Nodejs packages, such as bower and StatsD."
-    example <<~EXAMPLE
-      describe npm('bower') do
-        it { should be_installed }
-      end
-
-      describe npm('tar', path: '/path/to/project') do
-        it { should be_installed }
-      end
-    EXAMPLE
-
-    def initialize(package_name, opts = {})
-      @package_name = package_name
-      @location = opts[:path]
-      @cache = nil
-    end
-
-    def info
-      return @info if defined?(@info)
-
-      if @location
-        command_separator = inspec.os.platform?("windows") ? ";" : "&&"
-        invocation = "cd #{Shellwords.escape @location} #{command_separator} npm"
-      else
-        invocation = "npm -g"
-      end
-
-      invocation = "#{invocation} ls --json #{@package_name}"
-
-      # If on unix, wrap in sh -c to protect against sudo
-      unless inspec.os.platform?("windows")
-        invocation = "sh -c '#{invocation}'"
-      end
-
-      cmd = inspec.command(invocation)
-      @info = {
-        name: @package_name,
-        type: "npm",
-        installed: cmd.exit_status == 0,
-      }
-      return @info unless @info[:installed]
-
-      pkgs = JSON.parse(cmd.stdout)
-      @info[:version] = pkgs["dependencies"][@package_name]["version"]
-      @info
-    end
-
-    def installed?
-      info[:installed] == true
-    end
-
-    def version
-      info[:version]
-    end
-
-    def to_s
-      "Npm Package #{@package_name}"
-    end
-  end
-end