puppet 3.2.1 → 3.2.2

data/lib/puppet/status.rb

@@ -14,8 +14,12 @@ class Puppet::Status
     @status.to_pson
   end
 
-  def self.from_pson( pson )
-    self.new( pson )
+  def self.from_pson(pson)
+    if pson.include?('status')
+      self.new(pson['status'])
+    else
+      self.new(pson)
+    end
   end
 
   def name

data/lib/puppet/transaction/event.rb

@@ -18,12 +18,31 @@ class Puppet::Transaction::Event
 
   EVENT_STATUSES = %w{noop success failure audit}
 
+  def self.from_pson(data)
+    obj = self.allocate
+    obj.initialize_from_hash(data)
+    obj
+  end
+
   def initialize(options = {})
     @audited = false
     set_options(options)
     @time = Time.now
   end
 
+  def initialize_from_hash(data)
+    @audited = data['audited']
+    @property = data['property']
+    @previous_value = data['previous_value']
+    @desired_value = data['desired_value']
+    @historical_value = data['historical_value']
+    @message = data['message']
+    @name = data['name'].intern
+    @status = data['status']
+    @time = data['time']
+    @time = Time.parse(@time) if @time.is_a? String
+  end
+
   def property=(prop)
     @property = prop.to_s
   end

data/lib/puppet/transaction/report.rb

@@ -102,6 +102,12 @@ class Puppet::Transaction::Report
     :yaml
   end
 
+  def self.from_pson(data)
+    obj = self.allocate
+    obj.initialize_from_hash(data)
+    obj
+  end
+
   # @api private
   def <<(msg)
     @logs << msg
@@ -174,6 +180,40 @@ class Puppet::Transaction::Report
     @status = 'failed' # assume failed until the report is finalized
   end
 
+  # @api private
+  def initialize_from_hash(data)
+    @puppet_version = data['puppet_version']
+    @report_format = data['report_format']
+    @configuration_version = data['configuration_version']
+    @environment = data['environment']
+    @status = data['status']
+    @host = data['host']
+    @time = data['time']
+    if @time.is_a? String
+      @time = Time.parse(@time)
+    end
+    @kind = data['kind']
+
+    @metrics = {}
+    data['metrics'].each do |name, hash|
+      @metrics[name] = Puppet::Util::Metric.from_pson(hash)
+    end
+
+    @logs = data['logs'].map do |record|
+      Puppet::Util::Log.from_pson(record)
+    end
+
+    @resource_statuses = {}
+    data['resource_statuses'].map do |record|
+      if record[1] == {}
+        status = nil
+      else
+        status = Puppet::Resource::Status.from_pson(record[1])
+      end
+      @resource_statuses[record[0]] = status
+    end
+  end
+
   # @return [String] the host name
   # @api public
   #

data/lib/puppet/util/log.rb

@@ -220,6 +220,12 @@ class Puppet::Util::Log
     @levels.include?(level)
   end
 
+  def self.from_pson(data)
+    obj = allocate
+    obj.initialize_from_hash(data)
+    obj
+  end
+
   attr_accessor :time, :remote, :file, :line, :source
   attr_reader :level, :message
 
@@ -242,6 +248,19 @@ class Puppet::Util::Log
     Log.newmessage(self)
   end
 
+  def initialize_from_hash(data)
+    @level = data['level'].intern
+    @message = data['message']
+    @source = data['source']
+    @tags = data['tags']
+    @time = data['time']
+    if @time.is_a? String
+      @time = Time.parse(@time)
+    end
+    @file = data['file'] if data['file']
+    @line = data['line'] if data['line']
+  end
+
   def message=(msg)
     raise ArgumentError, "Puppet::Util::Log requires a message" unless msg
     @message = msg.to_s

data/lib/puppet/util/metric.rb

@@ -9,6 +9,12 @@ class Puppet::Util::Metric
 
   attr_writer :basedir
 
+  def self.from_pson(data)
+    metric = new(data['name'], data['label'])
+    metric.values = data['values']
+    metric
+  end
+
   # Return a specific value
   def [](name)
     if value = @values.find { |v| v[0] == name }

data/lib/puppet/util/monkey_patches.rb

@@ -41,21 +41,6 @@ end
   end
 }
 
-if defined?(YAML::ENGINE) and YAML::ENGINE.yamler == 'psych'
-  def Psych.safely_load(str)
-    result = Psych.parse(str)
-    if invalid_node = result.find { |node| node.tag =~ /!map:(.*)/ || node.tag =~ /!ruby\/hash:(.*)/ }
-      raise ArgumentError, "Illegal YAML mapping found with tag #{invalid_node.tag}; please use !ruby/object:#{$1} instead"
-    else
-      result.to_ruby
-    end
-  end
-else
-  def YAML.safely_load(str)
-    self.load(str)
-  end
-end
-
 def YAML.dump(*args)
   ZAML.dump(*args)
 end

data/lib/puppet/vendor.rb

@@ -0,0 +1,55 @@
+module Puppet
+  # Simple module to manage vendored code.
+  #
+  # To vendor a library:
+  #
+  # * Download its whole git repo or untar into `lib/puppet/vendor/<libname>`
+  # * Create a lib/puppetload_libraryname.rb file to add its libdir into the $:.
+  #   (Look at existing load_xxx files, they should all follow the same pattern).
+  # * To load the vendored lib upfront, add a `require '<vendorlib>'`line to
+  #   `vendor/require_vendored.rb`.
+  # * To load the vendored lib on demand, add a comment to `vendor/require_vendored.rb`
+  #    to make it clear it should not be loaded upfront.
+  #
+  # At runtime, the #load_vendored method should be called. It will ensure
+  # all vendored libraries are added to the global `$:` path, and
+  # will then call execute the up-front loading specified in `vendor/require_vendored.rb`.
+  #
+  # The intention is to not change vendored libraries and to eventually
+  # make adding them in optional so that distros can simply adjust their
+  # packaging to exclude this directory and the various load_xxx.rb scripts
+  # if they wish to install these gems as native packages.
+  #
+  class Vendor
+    class << self
+      # @api private
+      def vendor_dir
+        File.join([File.dirname(File.expand_path(__FILE__)), "vendor"])
+      end
+
+      # @api private
+      def load_entry(entry)
+        Puppet.debug("Loading vendored #{$1}")
+        load "#{vendor_dir}/#{entry}"
+      end
+
+      # @api private
+      def require_libs
+        require 'puppet/vendor/require_vendored'
+      end
+
+      # Configures the path for all vendored libraries and loads required libraries.
+      # (This is the entry point for loading vendored libraries).
+      #
+      def load_vendored
+        Dir.entries(vendor_dir).each do |entry|
+          if entry.match(/load_(\w+?)\.rb$/)
+            load_entry entry
+          end
+        end
+
+        require_libs
+      end
+    end
+  end
+end

data/lib/puppet/vendor/load_safe_yaml.rb

@@ -0,0 +1 @@
+$: << File.join([File.dirname(__FILE__), "safe_yaml/lib"])

data/lib/puppet/vendor/require_vendored.rb

@@ -0,0 +1,5 @@
+# This adds upfront requirements on vendored code found under lib/vendor/x
+# Add one requirement per vendored package (or a comment if it is loaded on demand).
+
+require 'safe_yaml'
+require 'puppet/vendor/safe_yaml_patches'

data/lib/puppet/vendor/safe_yaml/CHANGES.md

@@ -0,0 +1,104 @@
+0.9.2
+-----
+
+- fixed error w/ parsing "!" when whitelisting tags
+- fixed parsing of the number 0 (d'oh!)
+
+0.9.1
+-----
+
+- added Yecht support (JRuby)
+- more bug fixes
+
+0.9.0
+-----
+
+- added `whitelist!` method for easily whitelisting tags
+- added support for call-specific options
+- removed deprecated methods
+
+0.8.6
+-----
+
+- fixed bug in float matcher
+
+0.8.5
+-----
+
+- performance improvements
+- made less verbose by default
+- bug fixes
+
+0.8.4
+-----
+
+- enhancements to parsing of integers, floats, and dates
+- updated built-in whitelist
+- more bug fixes
+
+0.8.3
+-----
+
+- fixed exception on parsing empty document
+- fixed handling of octal & hexadecimal numbers
+
+0.8.2
+-----
+
+- bug fixes
+
+0.8.1
+-----
+
+- added `:raise_on_unknown_tag` option
+- renamed `reset_defaults!` to `restore_defaults!`
+
+0.8
+---
+
+- added tag whitelisting
+- more API changes
+
+0.7
+---
+
+- separated YAML engine support from Ruby version
+- added support for binary scalars
+- numerous bug fixes and enhancements
+
+0.6
+---
+
+- several API changes
+- added `SafeYAML::OPTIONS` for specifying default behavior
+
+0.5
+---
+
+Added support for dates
+
+0.4
+---
+
+- efficiency improvements
+- made `YAML.load` use `YAML.safe_load` by default
+- made symbol deserialization optional
+
+0.3
+---
+
+Added Syck support
+
+0.2
+---
+
+Added support for:
+
+- anchors & aliases
+- booleans
+- nils
+
+0.1
+---
+
+Initial release

data/lib/puppet/vendor/safe_yaml/Gemfile

@@ -0,0 +1,11 @@
+source "https://rubygems.org"
+
+gemspec
+
+group :development do
+  gem "hashie"
+  gem "heredoc_unindent"
+  gem "rake"
+  gem "rspec"
+  gem "travis-lint"
+end

data/lib/puppet/vendor/safe_yaml/LICENSE.txt

@@ -0,0 +1,22 @@
+Copyright (c) 2013 Dan Tao
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/lib/puppet/vendor/safe_yaml/README.md

@@ -0,0 +1,179 @@
+SafeYAML
+========
+
+[![Build Status](https://travis-ci.org/dtao/safe_yaml.png)](http://travis-ci.org/dtao/safe_yaml)
+
+The **SafeYAML** gem provides an alternative implementation of `YAML.load` suitable for accepting user input in Ruby applications. Unlike Ruby's built-in implementation of `YAML.load`, SafeYAML's version will not expose apps to arbitrary code execution exploits (such as [the ones discovered](http://www.reddit.com/r/netsec/comments/167c11/serious_vulnerability_in_ruby_on_rails_allowing/) [in Rails in early 2013](http://www.h-online.com/open/news/item/Rails-developers-close-another-extremely-critical-flaw-1793511.html)).
+
+**If you encounter any issues with SafeYAML, check out the 'Common Issues' section below.** If you don't see anything that addresses the problem you're experiencing, by all means, [create an issue](https://github.com/dtao/safe_yaml/issues/new)!
+
+Installation
+------------
+
+Add this line to your application's Gemfile:
+
+    gem "safe_yaml"
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install safe_yaml
+
+Configuration
+-------------
+
+Configuring SafeYAML should be quick. In most cases, you will probably only have to think about two things:
+
+1. What do you want the `YAML` module's *default* behavior to be? Set the `SafeYAML::OPTIONS[:default_mode]` option to either `:safe` or `:unsafe` to control this. If you do neither, SafeYAML will default to `:safe` mode but will issue a warning the first time you call `YAML.load`.
+2. Do you want to allow symbols by default? Set the `SafeYAML::OPTIONS[:deserialize_symbols]` option to `true` or `false` to control this. The default is `false`, which means that SafeYAML will deserialize symbols in YAML documents as strings.
+
+For more information on these and other options, see the "Usage" section down below.
+
+Explanation
+-----------
+
+Suppose your application were to use a popular open source library which contained code like this:
+
+```ruby
+class ClassBuilder
+  def []=(key, value)
+    @class ||= Class.new
+
+    @class.class_eval <<-EOS
+      def #{key}
+        #{value}
+      end
+    EOS
+  end
+
+  def create
+    @class.new
+  end
+end
+```
+
+Now, if you were to use `YAML.load` on user input anywhere in your application without the SafeYAML gem installed, an attacker who suspected you were using this library could send a request with a carefully-crafted YAML string to execute arbitrary code (yes, including `system("unix command")`) on your servers.
+
+This simple example demonstrates the vulnerability:
+
+```ruby
+yaml = <<-EOYAML
+--- !ruby/hash:ClassBuilder
+"foo; end; puts %(I'm in yr system!); def bar": "baz"
+EOYAML
+```
+
+    > YAML.load(yaml)
+    I'm in yr system!
+    => #<ClassBuilder:0x007fdbbe2e25d8 @class=#<Class:0x007fdbbe2e2510>>
+
+With SafeYAML, the same attacker would be thwarted:
+
+    > require "safe_yaml"
+    => true
+    > YAML.load(yaml, :safe => true)
+    => {"foo; end; puts %(I'm in yr system!); def bar"=>"baz"}
+
+Usage
+-----
+
+When you require the safe_yaml gem in your project, `YAML.load` is patched to accept one additional (optional) `options` parameter. This changes the method signature as follows:
+
+- for Syck and Psych prior to Ruby 1.9.3: `YAML.load(yaml, options={})`
+- for Psych in 1.9.3 and later: `YAML.load(yaml, filename=nil, options={})`
+
+The most important option is the `:safe` option (default: `true`), which controls whether or not to deserialize arbitrary objects when parsing a YAML document. The other options, along with explanations, are as follows.
+
+- `:deserialize_symbols` (default: `false`): Controls whether or not YAML will deserialize symbols. It is probably best to only enable this option where necessary, e.g. to make trusted libraries work. Symbols receive special treatment in Ruby and are not garbage collected, which means deserializing them indiscriminately may render your site vulnerable to a DOS attack (hence `false` as a default value).
+
+- `:whitelisted_tags`: Accepts an array of YAML tags that designate trusted types, e.g., ones that can be deserialized without worrying about any resulting security vulnerabilities. When any of the given tags are encountered in a YAML document, the associated data will be parsed by the underlying YAML engine (Syck or Psych) for the version of Ruby you are using. See the "Whitelisting Trusted Types" section below for more information.
+
+- `:custom_initializers`: Similar to the `:whitelisted_tags` option, but allows you to provide your own initializers for specified tags rather than using Syck or Psyck. Accepts a hash with string tags for keys and lambdas for values.
+
+- `:raise_on_unknown_tag` (default: `false`): Represents the highest possible level of paranoia (not necessarily a bad thing); if the YAML engine encounters any tag other than ones that are automatically trusted by SafeYAML or that you've explicitly whitelisted, it will raise an exception. This may be a good choice if you expect to always be dealing with perfectly safe YAML and want your application to fail loudly upon encountering questionable data.
+
+All of the above options can be set at the global level via `SafeYAML::OPTIONS`. You can also set each one individually per call to `YAML.load`; an option explicitly passed to `load` will take precedence over an option specified globally.
+
+Supported Types
+---------------
+
+The way that SafeYAML works is by restricting the kinds of objects that can be deserialized via `YAML.load`. More specifically, only the following types of objects can be deserialized by default:
+
+- Hashes
+- Arrays
+- Strings
+- Numbers
+- Dates
+- Times
+- Booleans
+- Nils
+
+Again, deserialization of symbols can be enabled globally by setting `SafeYAML::OPTIONS[:deserialize_symbols] = true`, or in a specific call to `YAML.load([some yaml], :deserialize_symbols => true)`.
+
+Whitelisting Trusted Types
+--------------------------
+
+SafeYAML supports whitelisting certain YAML tags for trusted types. This is handy when your application uses YAML to serialize and deserialize certain types not listed above, which you know to be free of any deserialization-related vulnerabilities.
+
+The easiest way to whitelist types is by calling `SafeYAML.whitelist!`, which can accept a variable number of safe types, e.g.:
+
+```ruby
+SafeYAML.whitelist!(FrobDispenser, GobbleFactory)
+```
+
+You can also whitelist YAML *tags* via the `:whitelisted_tags` option:
+
+```ruby
+# Using Syck
+SafeYAML::OPTIONS[:whitelisted_tags] = ["tag:ruby.yaml.org,2002:object:OpenStruct"]
+
+# Using Psych
+SafeYAML::OPTIONS[:whitelisted_tags] = ["!ruby/object:OpenStruct"]
+```
+
+And in case you were wondering: no, this feature will *not* allow would-be attackers to embed untrusted types within trusted types:
+
+```ruby
+yaml = <<-EOYAML
+--- !ruby/object:OpenStruct 
+table: 
+  :backdoor: !ruby/hash:ClassBuilder 
+    "foo; end; puts %(I'm in yr system!); def bar": "baz"
+EOYAML
+```
+
+    > YAML.safe_load(yaml)
+    => #<OpenStruct :backdoor={"foo; end; puts %(I'm in yr system!); def bar"=>"baz"}>
+
+Known Issues
+------------
+
+If you add SafeYAML to your project and start seeing any errors about missing keys, or you notice mysterious strings that look like `":foo"` (i.e., start with a colon), it's likely you're seeing errors from symbols being saved in YAML format. If you are able to modify the offending code, you might want to consider changing your YAML content to use plain vanilla strings instead of symbols. If not, you may need to set the `:deserialize_symbols` option to `true`, either in calls to `YAML.load` or--as a last resort--globally, with `SafeYAML::OPTIONS[:deserialize_symbols]`.
+
+Also be aware that some Ruby libraries, particularly those requiring inter-process communication, leverage YAML's object deserialization functionality and therefore may break or otherwise be impacted by SafeYAML. The following list includes known instances of SafeYAML's interaction with other Ruby gems:
+
+- [**ActiveRecord**](https://github.com/rails/rails/tree/master/activerecord): uses YAML to control serialization of model objects using the `serialize` class method. If you find that accessing serialized properties on your ActiveRecord models is causing errors, chances are you may need to:
+  1. set the `:deserialize_symbols` option to `true`,
+  2. whitelist some of the types in your serialized data via `SafeYAML.whitelist!` or the `:whitelisted_tags` option, or
+  3. both
+- [**Guard**](https://github.com/guard/guard): Uses YAML as a serialization format for notifications. The data serialized uses symbolic keys, so setting `SafeYAML::OPTIONS[:deserialize_symbols] = true` is necessary to allow Guard to work.
+- [**sidekiq**](https://github.com/mperham/sidekiq): Uses a YAML configiuration file with symbolic keys, so setting `SafeYAML::OPTIONS[:deserialize_symbols] = true` should allow it to work.
+
+The above list will grow over time, as more issues are discovered.
+
+Caveat
+------
+
+My intention is to eventually adopt [semantic versioning](http://semver.org/) with this gem, if it ever gets to version 1.0 (i.e., doesn't become obsolete by then). Since it isn't there yet, that means that API may well change from one version to the next. Please keep that in mind if you are using it in your application.
+
+To be clear: my *goal* is for SafeYAML to make it as easy as possible to protect existing applications from object deserialization exploits. Any and all feedback is more than welcome!
+
+Requirements
+------------
+
+SafeYAML requires Ruby 1.8.7 or newer and works with both [Syck](http://www.ruby-doc.org/stdlib-1.8.7/libdoc/yaml/rdoc/YAML.html) and [Psych](http://github.com/tenderlove/psych).
+
+If you are using a version of Ruby where Psych is the default YAML engine (e.g., 1.9.3) but you want to use Syck, be sure to set `YAML::ENGINE.yamler = "syck"` **before** requiring the safe_yaml gem.