inspec 4.18.51 → 4.18.85

data/lib/inspec/utils/filter_array.rb

@@ -1,25 +0,0 @@
-# copyright: 2015, Chef Software, Inc.
-
-class FilterArray
-  attr_accessor :rules
-  alias content rules
-
-  def initialize(rules)
-    @rules = rules
-  end
-
-  # allows for chaining
-  # .field('arch', 'b32').field('key', 'access').rules
-  def field(key, value = nil)
-    if value
-      res = rules.find_all { |r| r[key.to_sym] == value }
-      FilterArray.new(res)
-    else
-      rules.map { |h| h[key.to_sym] }.uniq
-    end
-  end
-
-  def method_missing(meth, *args)
-    field(meth, args[0])
-  end
-end

data/lib/inspec/utils/find_files.rb

@@ -1,44 +0,0 @@
-# copyright: 2015, Vulcano Security GmbH
-
-module FindFiles
-  TYPES = {
-    block: "b",
-    character: "c",
-    directory: "d",
-    pipe: "p",
-    file: "f",
-    link: "l",
-    socket: "s",
-    door: "D",
-  }.freeze
-
-  # ignores errors
-  def find_files(path, opts = {})
-    find_files_or_warn(path, opts) || []
-  end
-
-  def find_files_or_warn(path, opts = {})
-    depth = opts[:depth]
-    type = TYPES[opts[:type].to_sym] if opts[:type]
-
-    # If `path` contains a `'` we must modify how we quote the `sh -c` argument
-    quote = path.include?("'") ? '"' : "'"
-
-    cmd = "sh -c #{quote}find #{path}"
-    cmd += " -type #{type}" unless type.nil?
-    cmd += " -maxdepth #{depth.to_i}" if depth.to_i > 0
-    cmd += quote
-
-    result = inspec.command(cmd)
-    exit_status = result.exit_status
-
-    unless exit_status == 0
-      warn "find_files(): exit #{exit_status} from `#{cmd}`"
-      return nil
-    end
-
-    result.stdout.split("\n")
-      .map(&:strip)
-      .find_all { |x| !x.empty? }
-  end
-end

data/lib/inspec/utils/hash.rb

@@ -1,37 +0,0 @@
-class ::Hash
-  # Inspired by: http://stackoverflow.com/a/9381776
-  def deep_merge(second)
-    merger = proc { |_key, v1, v2|
-      v1.is_a?(Hash) && v2.is_a?(Hash) ? v1.merge(v2, &merger) : v2
-    }
-    merge(second, &merger)
-  end
-
-  # converts a deep hash into a flat hash
-  # hash = {
-  #   'a' => 1,
-  #   'b' => {'c' => 2},
-  # }
-  # hash.smash # => {"a"=>1, "b-c"=>2}
-  def smash(prefix = nil)
-    inject({}) do |acc, (key, value)|
-      index = prefix.to_s + key.to_s
-      if value.is_a?(Hash)
-        acc.merge(value.smash(index + "-"))
-      else
-        acc.merge(index => value)
-      end
-    end
-  end
-
-  # deep check if all values are contained
-  def contains(contains)
-    hash = smash
-    contains = contains.smash
-
-    contains.each do |key, val|
-      return false if hash[key] != val
-    end
-    true
-  end
-end

data/lib/inspec/utils/json_log.rb

@@ -1,15 +0,0 @@
-require "json"
-
-# a simple streaming json logger
-class Logger::JSONFormatter < Logger::Formatter
-  def call(severity, time, progname, msg)
-    puts JSON.generate(
-      {
-        "progname" => progname,
-        "severity" => severity,
-        "time" => time,
-        "msg" => msg,
-      }
-    )
-  end
-end

data/lib/inspec/utils/modulator.rb

@@ -1,9 +0,0 @@
-module Modulator
-  def modules
-    @modules ||= {}
-  end
-
-  def add_module(name, handler)
-    modules[name] = handler
-  end
-end

data/lib/inspec/utils/nginx_parser.rb

@@ -1,101 +0,0 @@
-require "parslet"
-
-class NginxParser < Parslet::Parser
-  root :outermost
-  # only designed for rabbitmq config files for now:
-  rule(:outermost) { filler? >> exp.repeat }
-
-  rule(:filler?) { one_filler.repeat }
-  rule(:one_filler) { match('\s+') | match["\n"] | comment }
-  rule(:space)   { match('\s+') }
-  rule(:comment) { str("#") >> (match["\n\r"].absent? >> any).repeat }
-
-  rule(:exp) do
-    section | assignment
-  end
-  rule(:assignment) do
-    (identifier >> values.maybe.as(:args)).as(:assignment) >> str(";") >> filler?
-  end
-
-  rule(:standard_identifier) do
-    (match("[a-zA-Z~*.]") >> match('\S').repeat).as(:identifier) >> space >> space.repeat
-  end
-
-  rule(:quoted_identifier) do
-    str('"') >> (str('"').absent? >> any).repeat.as(:identifier) >> str('"') >> space.repeat
-  end
-
-  rule(:identifier) do
-    standard_identifier | quoted_identifier
-  end
-
-  rule(:standard_value) do
-    ((match(/[#;{'"]/).absent? >> any) >> (
-      str('\\') >> any | match('[#;{]|\s').absent? >> any
-    ).repeat).as(:value) >> space.repeat
-  end
-
-  rule(:single_quoted_value) do
-    str("'") >> (
-      str('\\') >> any | str("'").absent? >> any
-    ).repeat.as(:value) >> str("'") >> space.repeat
-  end
-
-  rule(:double_quoted_value) do
-    str('"') >> (
-      str('\\') >> any | str('"').absent? >> any
-    ).repeat.as(:value) >> str('"') >> space.repeat
-  end
-
-  rule(:quoted_value) do
-    single_quoted_value | double_quoted_value
-  end
-
-  rule(:value) do
-    standard_value | quoted_value
-  end
-
-  rule(:values) do
-    value.repeat >> space.maybe
-  end
-
-  rule(:section) do
-    identifier.as(:section) >> values.maybe.as(:args) >> str("{") >> filler? >> exp.repeat.as(:expressions) >> str("}") >> filler?
-  end
-end
-
-class NginxTransform < Parslet::Transform
-  Group = Struct.new(:id, :args, :body)
-  Exp = Struct.new(:key, :vals)
-
-  def self.assemble_binary(seq)
-    b = ErlangBitstream.new
-    seq.each { |i| b.add(i) }
-    b.value
-  end
-
-  rule(section: { identifier: simple(:x) }, args: subtree(:y), expressions: subtree(:z)) { Group.new(x.to_s, y, z) }
-  rule(assignment: { identifier: simple(:x), args: subtree(:y) }) { Exp.new(x.to_s, y) }
-  rule(value: simple(:x)) { x.to_s }
-end
-
-class NginxConfig
-  def self.parse(content)
-    lex = NginxParser.new.parse(content)
-    tree = NginxTransform.new.apply(lex)
-    gtree = NginxTransform::Group.new(nil, "", tree)
-    read_nginx_group(gtree)
-  rescue Parslet::ParseFailed => err
-    raise "Failed to parse NginX config: #{err}"
-  end
-
-  def self.read_nginx_group(t)
-    agg_conf = Hash.new([])
-    agg_conf["_"] = t.args unless t.args == ""
-
-    groups, conf = t.body.partition { |i| i.is_a? NginxTransform::Group }
-    conf.each { |x| agg_conf[x.key] += [x.vals] }
-    groups.each { |x| agg_conf[x.id] += [read_nginx_group(x)] }
-    agg_conf
-  end
-end

data/lib/inspec/utils/object_traversal.rb

@@ -1,47 +0,0 @@
-module ObjectTraverser
-  def extract_value(keys, value)
-    return nil if value.nil?
-
-    key = keys.shift
-    return nil if key.nil?
-
-    # if the current value is not a Hash or Array, it is undefined
-    # behavior so value will be assigned nil by default.
-    value = if value.is_a?(Array)
-              extract_from_array(key, value)
-            elsif value.is_a?(Hash)
-              extract_from_hash(key, value)
-            end
-
-    # if there are no more keys, just return the value
-    return value if keys.first.nil?
-
-    # if there are more keys, extract more
-    extract_value(keys.clone, value)
-  end
-
-  private
-
-  # If the values to return from is an Array, allow returning by index.
-  # Otherwise, support methods on the Array itself.
-  def extract_from_array(key, value)
-    if key.is_a?(Integer)
-      value[key]
-    elsif value.respond_to?(key.to_sym)
-      value.send(key.to_sym)
-    end
-  end
-
-  # for Hashes, try to return the value by the key.
-  # We first try to find by the raw key before we stringify
-  # if the keys themselves are symbols, for example.
-  #
-  # This will return nil default if we can't find the key.
-  def extract_from_hash(key, value)
-    if value.key?(key)
-      value[key]
-    elsif value.key?(key.to_s)
-      value[key.to_s]
-    end
-  end
-end

data/lib/inspec/utils/parser.rb

@@ -1,277 +0,0 @@
-require "inspec/resources/command"
-
-module PasswdParser
-  # Parse /etc/passwd files.
-  #
-  # @param [String] content the raw content of /etc/passwd
-  # @return [Array] Collection of passwd entries
-  def parse_passwd(content)
-    content.to_s.split("\n").map do |line|
-      next if line[0] == "#"
-
-      parse_passwd_line(line)
-    end.compact
-  end
-
-  # Parse a line of /etc/passwd
-  #
-  # @param [String] line a line of /etc/passwd
-  # @return [Hash] Map of entries in this line
-  def parse_passwd_line(line)
-    x = line.split(":")
-    {
-      # rubocop:disable Layout/AlignHash
-      "user"     => x[0],
-      "password" => x[1],
-      "uid"      => x[2],
-      "gid"      => x[3],
-      "desc"     => x[4],
-      "home"     => x[5],
-      "shell"    => x[6],
-    }
-  end
-end
-
-module CommentParser
-  # Parse a line with a command. For example: `a = b   # comment`.
-  # Retrieves the actual content.
-  #
-  # @param [String] raw the content lines you want to be parsed
-  # @param [Hash] opts optional configuration
-  # @return [Array] contains the actual line and the position of the line end
-  def parse_comment_line(raw, opts)
-    idx_nl = raw.index("\n")
-    idx_comment = raw.index(opts[:comment_char])
-    idx_nl = raw.length if idx_nl.nil?
-    idx_comment = idx_nl + 1 if idx_comment.nil?
-    line = ""
-
-    # is a comment inside this line
-    if idx_comment < idx_nl && idx_comment != 0
-      line = raw[0..(idx_comment - 1)]
-      # in case we don't allow comments at the end
-      # of an assignment/statement, ignore it and fall
-      # back to treating this as a regular line
-      if opts[:standalone_comments] && !is_empty_line(line)
-        line = raw[0..(idx_nl - 1)]
-      end
-    # if there is no comment in this line
-    elsif idx_comment > idx_nl && idx_nl != 0
-      line = raw[0..(idx_nl - 1)]
-    end
-    [line, idx_nl]
-  end
-end
-
-module LinuxMountParser
-  # this parses the output of mount command (only tested on linux)
-  # this method expects only one line of the mount output
-  def parse_mount_options(mount_line, compatibility = false)
-    if includes_whitespaces?(mount_line)
-      # Device-/Sharenames and Mountpoints including whitespaces require special treatment:
-      # We use the keyword ' type ' to split up and rebuild the desired array of fields
-      type_split = mount_line.split(" type ")
-      fs_path = type_split[0]
-      other_opts = type_split[1]
-      fs, path = fs_path.match(%r{^(.+?)\son\s(/.+?)$}).captures
-      mount = [fs, "on", path, "type"]
-      mount.concat(other_opts.scan(/\S+/))
-    else
-      # ... otherwise we just split the fields by whitespaces
-      mount = mount_line.scan(/\S+/)
-    end
-
-    # parse device and type
-    mount_options    = { device: mount[0], type: mount[4] }
-
-    if compatibility == false
-      # parse options as array
-      mount_options[:options] = mount[5].gsub(/\(|\)/, "").split(",")
-    else
-      Inspec.deprecate(:mount_parser_serverspec_compat, "Parsing mount options in this fashion is deprecated")
-      mount_options[:options] = {}
-      mount[5].gsub(/\(|\)/, "").split(",").each do |option|
-        name, val = option.split("=")
-        if val.nil?
-          val = true
-        elsif val =~ /^\d+$/
-          # parse numbers
-          val = val.to_i
-        end
-        mount_options[:options][name.to_sym] = val
-      end
-    end
-
-    mount_options
-  end
-
-  # Device-/Sharename or Mountpoint includes whitespaces?
-  def includes_whitespaces?(mount_line)
-    ws = mount_line.match(/^(.+)\son\s(.+)\stype\s.*$/)
-    ws.captures[0].include?(" ") || ws.captures[1].include?(" ")
-  end
-end
-
-module BsdMountParser
-  # this parses the output of mount command (only tested on freebsd)
-  # this method expects only one line of the mount output
-  def parse_mount_options(mount_line, _compatibility = false)
-    return {} if mount_line.nil? || mount_line.empty?
-
-    mount = mount_line.chomp.split(" ", 4)
-    options = mount[3].tr("()", "").split(", ")
-
-    # parse device and type
-    { device: mount[0], type: options.shift, options: options }
-  end
-end
-
-module SolarisNetstatParser
-  # takes this as a input and parses the values
-  # UDP: IPv4
-  #    Local Address        Remote Address      State
-  # -------------------- -------------------- ----------
-  #       *.*                                 Unbound
-  def parse_netstat(content) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize
-    return [] if content.nil? || content.empty?
-
-    protocol = nil
-    column_widths = nil
-    ports = []
-    cache_name_line = nil
-
-    content.each_line do |line|
-      # find header, its delimiter
-      if line =~ /TCP:|UDP:|SCTP:/
-        # get protocol
-        protocol = line.split(":")[0].chomp.strip.downcase
-
-        # determine version tcp, tcp6, udp, udp6
-        proto_version = line.split(":")[1].chomp.strip
-        protocol += "6" if proto_version == "IPv6"
-
-        # reset names cache
-        column_widths = nil
-        cache_name_line = nil
-        names = nil
-      # calulate width of a column based on the horizontal line
-      elsif line =~ /^[- ]+$/
-        column_widths = columns(line)
-      # parse header values from line
-      elsif column_widths.nil? && !line.nil?
-        # we do not know the width at this point of time, therefore we need to cache
-        cache_name_line = line
-      # content line
-      elsif !column_widths.nil? && !line.nil? && !line.chomp.empty?
-        # default row
-        port = split_columns(column_widths, line).to_a.map { |v| v.chomp.strip }
-
-        # parse the header names
-        # TODO: names should be optional
-        names = split_columns(column_widths, cache_name_line).to_a.map { |v| v.chomp.strip.downcase.tr(" ", "-").gsub(/[^\w-]/, "_") }
-        info = {
-          "protocol" => protocol.downcase,
-        }
-
-        # generate hash for each line and use the names as keys
-        names.each_index do |i|
-          info[names[i]] = port[i] if i != 0
-        end
-
-        ports.push(info)
-      end
-    end
-    ports
-  end
-
-  private
-
-  # takes a line like "-------------------- -------------------- ----------"
-  # as input and calculates the length of each column
-  def columns(line)
-    # find all columns
-    m = line.scan(/-+/)
-    # calculate the length each column
-    m.map { |x| x.length } # rubocop:disable Style/SymbolProc
-  end
-
-  # takes a line and the width of the columns to extract the values
-  def split_columns(columns, line)
-    # generate regex based on columns
-    sep = '\\s'
-    length = columns.length
-    arr = columns.map.with_index do |x, i|
-      reg = "(.{#{x}})#{sep}" # add seperator between columns
-      reg = "(.{,#{x}})#{sep}" if i == length - 2 # make the pre-last one optional
-      reg = "(.{,#{x}})" if i == length - 1 # use , to say max value
-      reg
-    end
-    # extracts the columns
-    line.match(Regexp.new(arr.join))
-  end
-end
-
-# This parser for xinetd (extended Internet daemon) configuration files
-module XinetdParser
-  def xinetd_include_dir(dir)
-    return [] if dir.nil?
-
-    unless inspec.file(dir).directory?
-      raise Inspec::Exceptions::ResourceSkipped, "Can't find folder: #{dir}"
-    end
-
-    files = inspec.command("find #{dir} -type f").stdout.split("\n")
-    files.map { |file| parse_xinetd(read_content(file)) }
-  end
-
-  def parse_xinetd(raw) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
-    return {} if raw.nil?
-
-    require "inspec/utils/simpleconfig"
-
-    res = {}
-    cur_group = nil
-    simple_conf = []
-    rest = raw + "\n"
-    until rest.empty?
-      # extract content line
-      nl = rest.index("\n") || (rest.length - 1)
-      comment = rest.index("#") || (rest.length - 1)
-      dst_idx = comment < nl ? comment : nl
-      inner_line = dst_idx == 0 ? "" : rest[0..dst_idx - 1].strip
-      # update unparsed content
-      rest = rest[nl + 1..-1]
-      next if inner_line.empty?
-
-      if inner_line == "}"
-        if cur_group == "defaults"
-          res[cur_group] = SimpleConfig.new(simple_conf.join("\n"))
-        else
-          res[cur_group] ||= []
-          res[cur_group].push(SimpleConfig.new(simple_conf.join("\n")))
-        end
-        cur_group = nil
-      elsif rest.lstrip[0] == "{"
-        cur_group = inner_line
-        simple_conf = []
-        rest = rest[rest.index("\n") + 1..-1]
-      elsif cur_group.nil?
-        # parse all included files
-        others = xinetd_include_dir(inner_line[/includedir (.+)/, 1])
-
-        # complex merging of included configurations, as multiple services
-        # may be defined with the same name but different configuration
-        others.each do |ores|
-          ores.each do |k, v|
-            res[k] ||= []
-            res[k].concat(v)
-          end
-        end
-      else
-        simple_conf.push(inner_line)
-      end
-    end
-
-    res
-  end
-end