puppet 2.7.21 → 2.7.22

data/lib/puppet/vendor/safe_yaml/lib/safe_yaml/transform.rb

@@ -0,0 +1,41 @@
+require 'base64'
+
+module SafeYAML
+  class Transform
+    TRANSFORMERS = [
+      Transform::ToSymbol.new,
+      Transform::ToInteger.new,
+      Transform::ToFloat.new,
+      Transform::ToNil.new,
+      Transform::ToBoolean.new,
+      Transform::ToDate.new
+    ]
+
+    def self.to_guessed_type(value, quoted=false, options=nil)
+      return value if quoted
+
+      if value.is_a?(String)
+        TRANSFORMERS.each do |transformer|
+          success, transformed_value = transformer.method(:transform?).arity == 1 ?
+            transformer.transform?(value) :
+            transformer.transform?(value, options)
+
+          return transformed_value if success
+        end
+      end
+
+      value
+    end
+
+    def self.to_proper_type(value, quoted=false, tag=nil, options=nil)
+      case tag
+      when "tag:yaml.org,2002:binary", "x-private:binary", "!binary"
+        decoded = Base64.decode64(value)
+        decoded = decoded.force_encoding(value.encoding) if decoded.respond_to?(:force_encoding)
+        decoded
+      else
+        self.to_guessed_type(value, quoted, options)
+      end
+    end
+  end
+end

data/lib/puppet/vendor/safe_yaml/lib/safe_yaml/transform/to_boolean.rb

@@ -0,0 +1,21 @@
+module SafeYAML
+  class Transform
+    class ToBoolean
+      include TransformationMap
+
+      set_predefined_values({
+        "yes"   => true,
+        "on"    => true,
+        "true"  => true,
+        "no"    => false,
+        "off"   => false,
+        "false" => false
+      })
+
+      def transform?(value)
+        return false if value.length > 5
+        return PREDEFINED_VALUES.include?(value), PREDEFINED_VALUES[value]
+      end
+    end
+  end
+end

data/lib/puppet/vendor/safe_yaml/lib/safe_yaml/transform/to_date.rb

@@ -0,0 +1,11 @@
+module SafeYAML
+  class Transform
+    class ToDate
+      def transform?(value)
+        return true, Date.parse(value) if Parse::Date::DATE_MATCHER.match(value)
+        return true, Parse::Date.value(value) if Parse::Date::TIME_MATCHER.match(value)
+        false
+      end
+    end
+  end
+end

data/lib/puppet/vendor/safe_yaml/lib/safe_yaml/transform/to_float.rb

@@ -0,0 +1,33 @@
+module SafeYAML
+  class Transform
+    class ToFloat
+      Infinity = 1.0 / 0.0
+      NaN = 0.0 / 0.0
+
+      PREDEFINED_VALUES = {
+        ".inf"  => Infinity,
+        ".Inf"  => Infinity,
+        ".INF"  => Infinity,
+        "-.inf" => -Infinity,
+        "-.Inf" => -Infinity,
+        "-.INF" => -Infinity,
+        ".nan"  => NaN,
+        ".NaN"  => NaN,
+        ".NAN"  => NaN,
+      }.freeze
+
+      MATCHER = /\A[-+]?(?:\d[\d_]*)?\.[\d_]+(?:[eE][-+][\d]+)?\Z/.freeze
+
+      def transform?(value)
+        return true, Float(value) if MATCHER.match(value)
+        try_edge_cases?(value)
+      end
+
+      def try_edge_cases?(value)
+        return true, PREDEFINED_VALUES[value] if PREDEFINED_VALUES.include?(value)
+        return true, Parse::Sexagesimal.value(value) if Parse::Sexagesimal::FLOAT_MATCHER.match(value)
+        return false
+      end
+    end
+  end
+end

data/lib/puppet/vendor/safe_yaml/lib/safe_yaml/transform/to_integer.rb

@@ -0,0 +1,25 @@
+module SafeYAML
+  class Transform
+    class ToInteger
+      MATCHERS = Deep.freeze([
+        /\A[-+]?(0|([1-9][0-9_,]*))\Z/, # decimal
+        /\A0[0-7]+\Z/,                  # octal
+        /\A0x[0-9a-f]+\Z/i,             # hexadecimal
+        /\A0b[01_]+\Z/                  # binary
+      ])
+
+      def transform?(value)
+        MATCHERS.each do |matcher|
+          return true, Integer(value.gsub(",", "")) if matcher.match(value)
+        end
+        try_edge_cases?(value)
+      end
+
+      def try_edge_cases?(value)
+        return true, Parse::Hexadecimal.value(value) if Parse::Hexadecimal::MATCHER.match(value)
+        return true, Parse::Sexagesimal.value(value) if Parse::Sexagesimal::INTEGER_MATCHER.match(value)
+        return false
+      end
+    end
+  end
+end

data/lib/puppet/vendor/safe_yaml/lib/safe_yaml/transform/to_nil.rb

@@ -0,0 +1,18 @@
+module SafeYAML
+  class Transform
+    class ToNil
+      include TransformationMap
+
+      set_predefined_values({
+        ""      => nil,
+        "~"     => nil,
+        "null"  => nil,
+      })
+
+      def transform?(value)
+        return false if value.length > 4
+        return PREDEFINED_VALUES.include?(value), PREDEFINED_VALUES[value]
+      end
+    end
+  end
+end

data/lib/puppet/vendor/safe_yaml/lib/safe_yaml/transform/to_symbol.rb

@@ -0,0 +1,13 @@
+module SafeYAML
+  class Transform
+    class ToSymbol
+      MATCHER = /\A:"?(\w+)"?\Z/.freeze
+
+      def transform?(value, options=nil)
+        options ||= SafeYAML::OPTIONS
+        return false unless options[:deserialize_symbols] && MATCHER.match(value)
+        return true, $1.to_sym
+      end
+    end
+  end
+end

data/lib/puppet/vendor/safe_yaml/lib/safe_yaml/transform/transformation_map.rb

@@ -0,0 +1,47 @@
+module SafeYAML
+  class Transform
+    module TransformationMap
+      def self.included(base)
+        base.extend(ClassMethods)
+      end
+
+      class CaseAgnosticMap < Hash
+        def initialize(*args)
+          super
+        end
+
+        def include?(key)
+          super(key.downcase)
+        end
+
+        def [](key)
+          super(key.downcase)
+        end
+
+        # OK, I actually don't think it's all that important that this map be
+        # frozen.
+        def freeze
+          self
+        end
+      end
+
+      module ClassMethods
+        def set_predefined_values(predefined_values)
+          if SafeYAML::YAML_ENGINE == "syck"
+            expanded_map = predefined_values.inject({}) do |hash, (key, value)|
+              hash[key] = value
+              hash[key.capitalize] = value
+              hash[key.upcase] = value
+              hash
+            end
+          else
+            expanded_map = CaseAgnosticMap.new
+            expanded_map.merge!(predefined_values)
+          end
+
+          self.const_set(:PREDEFINED_VALUES, expanded_map.freeze)
+        end
+      end
+    end
+  end
+end

data/lib/puppet/vendor/safe_yaml/lib/safe_yaml/version.rb

@@ -0,0 +1,3 @@
+module SafeYAML
+  VERSION = "0.9.2"
+end

data/lib/puppet/vendor/safe_yaml/run_specs_all_ruby_versions.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+[[ -s "$HOME/.rvm/scripts/rvm" ]] && . "$HOME/.rvm/scripts/rvm"
+
+rvm use 1.8.7@safe_yaml
+rake spec
+
+rvm use 1.9.2@safe_yaml
+YAMLER=syck rake spec
+
+rvm use 1.9.3@safe_yaml
+YAMLER=syck rake spec
+
+rvm use 1.9.2@safe_yaml
+YAMLER=psych rake spec
+
+rvm use 1.9.3@safe_yaml
+YAMLER=psych rake spec
+
+rvm use 2.0.0@safe_yaml
+YAMLER=psych rake spec

data/lib/puppet/vendor/safe_yaml/safe_yaml.gemspec

@@ -0,0 +1,18 @@
+# -*- encoding: utf-8 -*-
+require File.join(File.dirname(__FILE__), "lib", "safe_yaml", "version")
+
+Gem::Specification.new do |gem|
+  gem.name          = "safe_yaml"
+  gem.version       = SafeYAML::VERSION
+  gem.authors       = "Dan Tao"
+  gem.email         = "daniel.tao@gmail.com"
+  gem.description   = %q{Parse YAML safely, without that pesky arbitrary object deserialization vulnerability}
+  gem.summary       = %q{SameYAML provides an alternative implementation of YAML.load suitable for accepting user input in Ruby applications.}
+  gem.homepage      = "http://dtao.github.com/safe_yaml/"
+  gem.license       = "MIT"
+  gem.files         = `git ls-files`.split($\)
+  gem.test_files    = gem.files.grep(%r{^spec/})
+  gem.require_paths = ["lib"]
+
+  gem.required_ruby_version = ">= 1.8.7"
+end

data/lib/puppet/vendor/safe_yaml/spec/exploit.1.9.2.yaml

@@ -0,0 +1,2 @@
+--- !ruby/object:ExploitableBackDoor
+foo: bar

data/lib/puppet/vendor/safe_yaml/spec/exploit.1.9.3.yaml

@@ -0,0 +1,2 @@
+--- !ruby/hash:ExploitableBackDoor
+foo: bar

data/lib/puppet/vendor/safe_yaml/spec/psych_resolver_spec.rb

@@ -0,0 +1,10 @@
+require File.join(File.dirname(__FILE__), "spec_helper")
+
+if SafeYAML::YAML_ENGINE == "psych"
+  require "safe_yaml/psych_resolver"
+
+  describe SafeYAML::PsychResolver do
+    include ResolverSpecs
+    let(:resolver) { SafeYAML::PsychResolver.new }
+  end
+end

data/lib/puppet/vendor/safe_yaml/spec/resolver_specs.rb

@@ -0,0 +1,250 @@
+module ResolverSpecs
+  def self.included(base)
+    base.module_eval do
+      let(:resolver) { nil }
+      let(:result) { @result }
+
+      def parse(yaml)
+        tree = YAML.parse(yaml.unindent)
+        @result = resolver.resolve_node(tree)
+      end
+
+      # Isn't this how I should've been doing it all along?
+      def parse_and_test(yaml)
+        parse(yaml)
+        @result.should == YAML.unsafe_load(yaml)
+      end
+
+      context "by default" do
+        it "translates maps to hashes" do
+          parse <<-YAML
+            potayto: potahto
+            tomayto: tomahto
+          YAML
+
+          result.should == {
+            "potayto" => "potahto",
+            "tomayto" => "tomahto"
+          }
+        end
+
+        it "translates sequences to arrays" do
+          parse <<-YAML
+            - foo
+            - bar
+            - baz
+          YAML
+
+          result.should == ["foo", "bar", "baz"]
+        end
+
+        it "translates most values to strings" do
+          parse "string: value"
+          result.should == { "string" => "value" }
+        end
+
+        it "does not deserialize symbols" do
+          parse ":symbol: value"
+          result.should == { ":symbol" => "value" }
+        end
+
+        it "translates valid integral numbers to integers" do
+          parse "integer: 1"
+          result.should == { "integer" => 1 }
+        end
+
+        it "translates valid decimal numbers to floats" do
+          parse "float: 3.14"
+          result.should == { "float" => 3.14 }
+        end
+
+        it "translates valid dates" do
+          parse "date: 2013-01-24"
+          result.should == { "date" => Date.parse("2013-01-24") }
+        end
+
+        it "translates valid true/false values to booleans" do
+          parse <<-YAML
+            - yes
+            - true
+            - no
+            - false
+          YAML
+
+          result.should == [true, true, false, false]
+        end
+
+        it "translates valid nulls to nil" do
+          parse <<-YAML
+            - 
+            - ~
+            - null
+          YAML
+
+          result.should == [nil] * 3
+        end
+
+        it "matches the behavior of the underlying YAML engine w/ respect to capitalization of boolean values" do
+          parse_and_test <<-YAML
+            - true
+            - True
+            - TRUE
+            - tRue
+            - TRue
+            - False
+            - FALSE
+            - fAlse
+            - FALse
+          YAML
+
+          # using Syck: [true, true, true, "tRue", "TRue", false, false, "fAlse", "FALse"]
+          # using Psych: all booleans
+        end
+
+        it "matches the behavior of the underlying YAML engine w/ respect to capitalization of nil values" do
+          parse_and_test <<-YAML
+            - Null
+            - NULL
+            - nUll
+            - NUll
+          YAML
+
+          # using Syck: [nil, nil, "nUll", "NUll"]
+          # using Psych: all nils
+        end
+
+        it "translates quoted empty strings to strings (not nil)" do
+          parse "foo: ''"
+          result.should == { "foo" => "" }
+        end
+
+        it "correctly reverse-translates strings encoded via #to_yaml" do
+          parse "5.10".to_yaml
+          result.should == "5.10"
+        end
+
+        it "does not specially parse any double-quoted strings" do
+          parse <<-YAML
+            - "1"
+            - "3.14"
+            - "true"
+            - "false"
+            - "2013-02-03"
+            - "2013-02-03 16:27:00 -0600"
+          YAML
+
+          result.should == ["1", "3.14", "true", "false", "2013-02-03", "2013-02-03 16:27:00 -0600"]
+        end
+
+        it "does not specially parse any single-quoted strings" do
+          parse <<-YAML
+            - '1'
+            - '3.14'
+            - 'true'
+            - 'false'
+            - '2013-02-03'
+            - '2013-02-03 16:27:00 -0600'
+          YAML
+
+          result.should == ["1", "3.14", "true", "false", "2013-02-03", "2013-02-03 16:27:00 -0600"]
+        end
+
+        it "deals just fine with nested maps" do
+          parse <<-YAML
+            foo:
+              bar:
+                marco: polo
+          YAML
+
+          result.should == { "foo" => { "bar" => { "marco" => "polo" } } }
+        end
+
+        it "deals just fine with nested sequences" do
+          parse <<-YAML
+            - foo
+            -
+              - bar1
+              - bar2
+              -
+                - baz1
+                - baz2
+          YAML
+
+          result.should == ["foo", ["bar1", "bar2", ["baz1", "baz2"]]]
+        end
+
+        it "applies the same transformations to keys as to values" do
+          parse <<-YAML
+            foo: string
+            :bar: symbol
+            1: integer
+            3.14: float
+            2013-01-24: date
+          YAML
+
+          result.should == {
+            "foo"  => "string",
+            ":bar" => "symbol",
+            1      => "integer",
+            3.14   => "float",
+            Date.parse("2013-01-24") => "date",
+          }
+        end
+
+        it "applies the same transformations to elements in sequences as to all values" do
+          parse <<-YAML
+            - foo
+            - :bar
+            - 1
+            - 3.14
+            - 2013-01-24
+          YAML
+
+          result.should == ["foo", ":bar", 1, 3.14, Date.parse("2013-01-24")]
+        end
+      end
+
+      context "for Ruby version #{RUBY_VERSION}" do
+        it "translates valid time values" do
+          parse "time: 2013-01-29 05:58:00 -0800"
+          result.should == { "time" => Time.utc(2013, 1, 29, 13, 58, 0) }
+        end
+
+        it "applies the same transformation to elements in sequences" do
+          parse "- 2013-01-29 05:58:00 -0800"
+          result.should == [Time.utc(2013, 1, 29, 13, 58, 0)]
+        end
+
+        it "applies the same transformation to keys" do
+          parse "2013-01-29 05:58:00 -0800: time"
+          result.should == { Time.utc(2013, 1, 29, 13, 58, 0) => "time" }
+        end
+      end
+
+      context "with symbol deserialization enabled" do
+        before :each do
+          SafeYAML::OPTIONS[:deserialize_symbols] = true
+        end
+
+        after :each do
+          SafeYAML.restore_defaults!
+        end
+
+        it "translates values starting with ':' to symbols" do
+          parse "symbol: :value"
+          result.should == { "symbol" => :value }
+        end
+
+        it "applies the same transformation to keys" do
+          parse ":bar: symbol"
+          result.should == { :bar  => "symbol" }
+        end
+
+        it "applies the same transformation to elements in sequences" do
+          parse "- :bar"
+          result.should == [:bar]
+        end
+      end
+    end
+  end
+end