puppet 5.0.0 → 6.0.0

data/lib/puppet/util/windows/sid.rb

@@ -52,18 +52,18 @@ module Puppet::Util::Windows
     # 'BUILTIN\Administrators', or 'S-1-5-32-544', and will return the
     # SID. Returns nil if the account doesn't exist.
     def name_to_sid(name)
-      sid = name_to_sid_object(name)
+      sid = name_to_principal(name)
 
       sid ? sid.sid : nil
     end
     module_function :name_to_sid
 
-    # Convert an account name, e.g. 'Administrators' into a SID object,
+    # Convert an account name, e.g. 'Administrators' into a Principal::SID object,
     # e.g. 'S-1-5-32-544'. The name can be specified as 'Administrators',
     # 'BUILTIN\Administrators', or 'S-1-5-32-544', and will return the
     # SID object. Returns nil if the account doesn't exist.
     # This method returns a SID::Principal with the account, domain, SID, etc
-    def name_to_sid_object(name)
+    def name_to_principal(name)
       # Apparently, we accept a symbol..
       name = name.to_s.strip if name
 
@@ -71,7 +71,6 @@ module Puppet::Util::Windows
       raw_sid_bytes = nil
       begin
         string_to_sid_ptr(name) do |sid_ptr|
-          valid = ! sid_ptr.nil? && ! sid_ptr.null?
           raw_sid_bytes = sid_ptr.read_array_of_uchar(get_length_sid(sid_ptr))
         end
       rescue
@@ -81,21 +80,50 @@ module Puppet::Util::Windows
     rescue
       nil
     end
-    module_function :name_to_sid_object
+    module_function :name_to_principal
+    class << self; alias name_to_sid_object name_to_principal; end
 
-    # Converts an octet string array of bytes to a SID object,
+    # Converts an octet string array of bytes to a SID::Principal object,
     # e.g. [1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0] is the representation for
     # S-1-5-18, the local 'SYSTEM' account.
     # Raises an Error for nil or non-array input.
     # This method returns a SID::Principal with the account, domain, SID, etc
-    def octet_string_to_sid_object(bytes)
+    def octet_string_to_principal(bytes)
       if !bytes || !bytes.respond_to?('pack') || bytes.empty?
         raise Puppet::Util::Windows::Error.new(_("Octet string must be an array of bytes"))
       end
 
       Principal.lookup_account_sid(bytes)
     end
-    module_function :octet_string_to_sid_object
+    module_function :octet_string_to_principal
+    class << self; alias octet_string_to_sid_object octet_string_to_principal; end
+
+    # Converts a COM instance of IAdsUser or IAdsGroup to a SID::Principal object,
+    # Raises an Error for nil or an object without an objectSID / Name property.
+    # This method returns a SID::Principal with the account, domain, SID, etc
+    # This method will return instances even when the SID is unresolvable, as
+    # may be the case when domain users have been added to local groups, but
+    # removed from the domain
+    def ads_to_principal(ads_object)
+      if !ads_object || !ads_object.respond_to?(:ole_respond_to?) ||
+        !ads_object.ole_respond_to?(:objectSID) || !ads_object.ole_respond_to?(:Name)
+        raise Puppet::Error.new("ads_object must be an IAdsUser or IAdsGroup instance")
+      end
+      octet_string_to_principal(ads_object.objectSID)
+    rescue Puppet::Util::Windows::Error => e
+      # if the error is not a lookup / mapping problem, immediately re-raise
+      raise if e.code != ERROR_NONE_MAPPED
+
+      # if the Name property isn't formatted like a SID, OR
+      if !valid_sid?(ads_object.Name) ||
+        # if the objectSID doesn't match the Name property, also raise
+        ((converted = octet_string_to_sid_string(ads_object.objectSID)) != ads_object.Name)
+        raise Puppet::Error.new("ads_object Name: #{ads_object.Name} invalid or does not match objectSID: #{ads_object.objectSID} (#{converted})", e)
+      end
+
+      unresolved_principal(ads_object.Name, ads_object.objectSID)
+    end
+    module_function :ads_to_principal
 
     # Convert a SID string, e.g. "S-1-5-32-544" to a name,
     # e.g. 'BUILTIN\Administrators'. Returns nil if an account
@@ -105,7 +133,6 @@ module Puppet::Util::Windows
       sid_bytes = []
       begin
         string_to_sid_ptr(value) do |ptr|
-          valid = ! ptr.nil? && ! ptr.null?
           sid_bytes = ptr.read_array_of_uchar(get_length_sid(ptr))
         end
       rescue Puppet::Util::Windows::Error => e
@@ -193,6 +220,30 @@ module Puppet::Util::Windows
     end
     module_function :get_length_sid
 
+    def octet_string_to_sid_string(sid_bytes)
+      sid_string = nil
+
+      FFI::MemoryPointer.new(:byte, sid_bytes.length) do |sid_ptr|
+        sid_ptr.write_array_of_uchar(sid_bytes)
+        sid_string = Puppet::Util::Windows::SID.sid_ptr_to_string(sid_ptr)
+      end
+
+      sid_string
+    end
+    module_function :octet_string_to_sid_string
+
+    # @api private
+    def self.unresolved_principal(name, sid_bytes)
+      Principal.new(
+        name + " (unresolvable)", # account
+        sid_bytes, # sid_bytes
+        name, # sid string
+        nil, #domain
+        # https://msdn.microsoft.com/en-us/library/cc245534.aspx?f=255&MSPPError=-2147217396
+        # Indicates that the type of object could not be determined. For example, no object with that SID exists.
+        :SidTypeUnknown)
+    end
+
     ffi_convention :stdcall
 
     # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379151(v=vs.85).aspx

data/lib/puppet/util/windows.rb

@@ -1,8 +1,10 @@
+require 'puppet/util/platform'
 module Puppet::Util::Windows
   module ADSI
-    class User; end
+    class ADSIObject; end
+    class User < ADSIObject; end
     class UserProfile; end
-    class Group; end
+    class Group < ADSIObject; end
   end
   module File; end
   module Registry
@@ -13,6 +15,20 @@ module Puppet::Util::Windows
   class EventLog; end
 
   if Puppet::Util::Platform.windows?
+    require 'Win32API' # case matters in this require!
+
+    # Note: Setting codepage here globally ensures all strings returned via
+    # WIN32OLE (Ruby's late-bound COM support) are encoded in Encoding::UTF_8
+    #
+    # Also, this does not modify the value of WIN32OLE.locale - which defaults
+    # to 2048 (at least on US English Windows) and is not listed in the MS
+    # locales table, here: https://msdn.microsoft.com/en-us/library/ms912047(v=winembedded.10).aspx
+    require 'win32ole' ; WIN32OLE.codepage = WIN32OLE::CP_UTF8
+    # gems
+    require 'win32/process'
+    require 'win32/dir'
+    require 'win32/service'
+
     # these reference platform specific gems
     require 'puppet/util/windows/api_types'
     require 'puppet/util/windows/string'
@@ -31,5 +47,6 @@ module Puppet::Util::Windows
     require 'puppet/util/windows/adsi'
     require 'puppet/util/windows/registry'
     require 'puppet/util/windows/eventlog'
+    require 'puppet/util/windows/service'
   end
 end

data/lib/puppet/util/yaml.rb

@@ -1,15 +1,51 @@
 require 'yaml'
 
 module Puppet::Util::Yaml
-  if defined?(::Psych::SyntaxError)
-    YamlLoadExceptions = [::StandardError, ::Psych::SyntaxError]
-  else
-    YamlLoadExceptions = [::StandardError]
-  end
+  YamlLoadExceptions = [::StandardError, ::Psych::Exception]
 
   class YamlLoadError < Puppet::Error; end
 
+  # Safely load the content as YAML. By default only the following
+  # classes can be deserialized:
+  #
+  # * TrueClass
+  # * FalseClass
+  # * NilClass
+  # * Numeric
+  # * String
+  # * Array
+  # * Hash
+  #
+  # Attempting to deserialize other classes will raise an YamlLoadError
+  # exception unless they are specified in the array of *allowed_classes*.
+  # @param [String] yaml The yaml content to parse.
+  # @param [Array] allowed_classes Additional list of classes that can be deserialized.
+  # @param [String] filename The filename to load from, used if an exception is raised.
+  # @raise [YamlLoadException] If deserialization fails.
+  # @return The parsed YAML, which can be Hash, Array or scalar types.
+  def self.safe_load(yaml, allowed_classes = [], filename = nil)
+    data = YAML.safe_load(yaml, allowed_classes, [], true, filename)
+    data = false if data.nil?
+    data
+  rescue ::Psych::DisallowedClass => detail
+    path = filename ? "(#{filename})" : "(<unknown>)"
+    raise YamlLoadError.new("#{path}: #{detail.message}", detail)
+  rescue *YamlLoadExceptions => detail
+    raise YamlLoadError.new(detail.message, detail)
+  end
+
+  # Safely load the content from a file as YAML.
+  #
+  # @see Puppet::Util::Yaml.safe_load
+  def self.safe_load_file(filename, allowed_classes = [])
+    yaml = Puppet::FileSystem.read(filename, :encoding => 'bom|utf-8')
+    safe_load(yaml, allowed_classes, filename)
+  end
+
+  # @deprecated Use {#safe_load_file} instead.
   def self.load_file(filename, default_value = false, strip_classes = false)
+    Puppet.deprecation_warning(_("Puppet::Util::Yaml.load_file is deprecated. Use safe_load_file instead."))
+
     if(strip_classes) then
       data = YAML::parse_file(filename)
       data.root.each do |o|

data/lib/puppet/util.rb

@@ -22,13 +22,12 @@ module Util
   require 'puppet/util/posix'
   extend Puppet::Util::POSIX
 
-  # Can't use Puppet.features.microsoft_windows? as it may be mocked out in a test.  This can cause test recurring test failures
   require 'puppet/util/windows/process' if Puppet::Util::Platform.windows?
 
   extend Puppet::Util::SymbolicFileMode
 
   def default_env
-    Puppet.features.microsoft_windows? ?
+    Puppet::Util::Platform.windows? ?
       :windows :
       :posix
   end
@@ -197,25 +196,33 @@ module Util
     }
   end
 
+  # execute a block of work and based on the logging level provided, log the provided message with the seconds taken
+  # The message 'msg' should include string ' in %{seconds} seconds' as part of the message and any content should escape
+  # any percent signs '%' so that they are not interpreted as formatting commands
+  #     escaped_str = str.gsub(/%/, '%%')
+  #
+  # @param msg [String] the message to be formated to assigned the %{seconds} seconds take to execute,
+  #                     other percent signs '%' need to be escaped
+  # @param level [Symbol] the logging level for this message
+  # @param object [Object] The object use for logging the message
   def benchmark(*args)
     msg = args.pop
     level = args.pop
-    object = nil
-
-    if args.empty?
-      if respond_to?(level)
-        object = self
-      else
-        object = Puppet
-      end
-    else
-      object = args.pop
-    end
-
-    raise Puppet::DevError, "Failed to provide level to :benchmark" unless level
+    object = if args.empty?
+               if respond_to?(level)
+                 self
+               else
+                 Puppet
+               end
+             else
+               args.pop
+             end
+
+    #TRANSLATORS 'benchmark' is a method name and should not be translated
+    raise Puppet::DevError, _("Failed to provide level to benchmark") unless level
 
     unless level == :none or object.respond_to? level
-      raise Puppet::DevError, "Benchmarked object does not respond to #{level}"
+      raise Puppet::DevError, _("Benchmarked object does not respond to %{value}") % { value: level }
     end
 
     # Only benchmark if our log level is high enough
@@ -223,9 +230,7 @@ module Util
       seconds = Benchmark.realtime {
         yield
       }
-      #TRANSLATORS forms the end of a string indicating how long a
-      # given operation took
-      object.send(level, msg + (_(" in %0.2f seconds") % seconds))
+      object.send(level, msg % { seconds: "%0.2f" % seconds })
       return seconds
     else
       yield
@@ -266,7 +271,7 @@ module Util
             raise
           end
         else
-          if Puppet.features.microsoft_windows? && File.extname(dest).empty?
+          if Puppet::Util::Platform.windows? && File.extname(dest).empty?
             exts.each do |ext|
               destext = File.expand_path(dest + ext)
               return destext if FileTest.file? destext and FileTest.executable? destext
@@ -294,6 +299,8 @@ module Util
     # would use Puppet.features.microsoft_windows?, but this method needs to
     # be called during the initialization of features so it can't depend on
     # that.
+    #
+    # @deprecated Use ruby's built-in methods to determine if a path is absolute.
     platform ||= Puppet::Util::Platform.windows? ? :windows : :posix
     regex = case platform
             when :windows
@@ -301,7 +308,7 @@ module Util
             when :posix
               AbsolutePathPosix
             else
-              raise Puppet::DevError, "unknown platform #{platform} in absolute_path"
+              raise Puppet::DevError, _("unknown platform %{platform} in absolute_path") % { platform: platform }
             end
 
     !! (path =~ regex)
@@ -314,7 +321,7 @@ module Util
 
     params = { :scheme => 'file' }
 
-    if Puppet.features.microsoft_windows?
+    if Puppet::Util::Platform.windows?
       path = path.gsub(/\\/, '/')
 
       if unc = /^\/\/([^\/]+)(\/.+)/.match(path)
@@ -348,7 +355,7 @@ module Util
     # URI.unescape does, but returns strings in their original encoding
     path = URI.unescape(uri.path.encode(Encoding::UTF_8))
 
-    if Puppet.features.microsoft_windows? and uri.scheme == 'file'
+    if Puppet::Util::Platform.windows? && uri.scheme == 'file'
       if uri.host
         path = "//#{uri.host}" + path # UNC
       else
@@ -360,12 +367,8 @@ module Util
   end
   module_function :uri_to_path
 
-  private
-
   RFC_3986_URI_REGEX = /^(?<scheme>([^:\/?#]+):)?(?<authority>\/\/([^\/?#]*))?(?<path>[^?#]*)(\?(?<query>[^#]*))?(#(?<fragment>.*))?$/
 
-  public
-
   # Percent-encodes a URI query parameter per RFC3986 - https://tools.ietf.org/html/rfc3986
   #
   # The output will correctly round-trip through URI.unescape
@@ -439,7 +442,7 @@ module Util
   #   query will encode + as %2B and space as %20
   #   fragment behaves like query
   def uri_encode(path, opts = { :allow_fragment => false })
-    raise ArgumentError.new('path may not be nil') if path.nil?
+    raise ArgumentError.new(_('path may not be nil')) if path.nil?
 
     # ensure string starts as UTF-8 for the sake of Ruby 1.9.3
     encoded = ''.encode!(Encoding::UTF_8)
@@ -557,16 +560,16 @@ module Util
   DEFAULT_WINDOWS_MODE = nil
 
   def replace_file(file, default_mode, &block)
-    raise Puppet::DevError, "replace_file requires a block" unless block_given?
+    raise Puppet::DevError, _("replace_file requires a block") unless block_given?
 
     if default_mode
       unless valid_symbolic_mode?(default_mode)
-        raise Puppet::DevError, "replace_file default_mode: #{default_mode} is invalid"
+        raise Puppet::DevError, _("replace_file default_mode: %{default_mode} is invalid") % { default_mode: default_mode }
       end
 
       mode = symbolic_mode_to_int(normalize_symbolic_mode(default_mode))
     else
-      if Puppet.features.microsoft_windows?
+      if Puppet::Util::Platform.windows?
         mode = DEFAULT_WINDOWS_MODE
       else
         mode = DEFAULT_POSIX_MODE
@@ -578,17 +581,10 @@ module Util
       # encoding for Uniquefile is not important here because the caller writes to it as it sees fit
       tempfile = Puppet::FileSystem::Uniquefile.new(Puppet::FileSystem.basename_string(file), Puppet::FileSystem.dir_string(file))
 
-      # Set properties of the temporary file before we write the content, because
-      # Tempfile doesn't promise to be safe from reading by other people, just
-      # that it avoids races around creating the file.
-      #
-      # Our Windows emulation is pretty limited, and so we have to carefully
-      # and specifically handle the platform, which has all sorts of magic.
-      # So, unlike Unix, we don't pre-prep security; we use the default "quite
-      # secure" tempfile permissions instead.  Magic happens later.
-      if !Puppet.features.microsoft_windows?
+      effective_mode =
+      if !Puppet::Util::Platform.windows?
         # Grab the current file mode, and fall back to the defaults.
-        effective_mode =
+
         if Puppet::FileSystem.exist?(file)
           stat = Puppet::FileSystem.lstat(file)
           tempfile.chown(stat.uid, stat.gid)
@@ -596,17 +592,17 @@ module Util
         else
           mode
         end
-
-        if effective_mode
-          # We only care about the bottom four slots, which make the real mode,
-          # and not the rest of the platform stat call fluff and stuff.
-          tempfile.chmod(effective_mode & 07777)
-        end
       end
 
       # OK, now allow the caller to write the content of the file.
       yield tempfile
 
+      if effective_mode
+        # We only care about the bottom four slots, which make the real mode,
+        # and not the rest of the platform stat call fluff and stuff.
+        tempfile.chmod(effective_mode & 07777)
+      end
+
       # Now, make sure the data (which includes the mode) is safe on disk.
       tempfile.flush
       begin
@@ -623,7 +619,7 @@ module Util
 
       tempfile.close
 
-      if Puppet.features.microsoft_windows?
+      if Puppet::Util::Platform.windows?
         # Windows ReplaceFile needs a file to exist, so touch handles this
         if !Puppet::FileSystem.exist?(file)
           Puppet::FileSystem.touch(file)
@@ -636,6 +632,11 @@ module Util
         Puppet::Util::Windows::File.replace_file(FileSystem.path_string(file), tempfile.path)
 
       else
+        # MRI Ruby checks for this and raises an error, while JRuby removes the directory
+        # and replaces it with a file. This makes the our version of replace_file() consistent
+        if Puppet::FileSystem.exist?(file) && Puppet::FileSystem.directory?(file)
+          raise Errno::EISDIR, _("Is a directory: %{directory}") % { directory: file }
+        end
         File.rename(tempfile.path, Puppet::FileSystem.path_string(file))
       end
     ensure
@@ -675,7 +676,7 @@ module Util
     ## NOTE: when debugging spec failures, these two lines can be very useful
     #puts err.inspect
     #puts Puppet::Util.pretty_backtrace(err.backtrace)
-    Puppet.log_exception(err, _("Could not %{message}: %{err}") % { message: message, err: err })
+    Puppet.log_exception(err, "#{message}: #{err}")
     Puppet::Util::Log.force_flushqueue()
     exit(code)
   end
@@ -695,7 +696,6 @@ end
 
 
 require 'puppet/util/errors'
-require 'puppet/util/methodhelper'
 require 'puppet/util/metaid'
 require 'puppet/util/classgen'
 require 'puppet/util/docs'

data/lib/puppet/vendor/deep_merge/README.md

@@ -105,8 +105,8 @@ Simple Example Code
     y.deep_merge!(x)
     # results: y = {:x => [1,2,3,4,5]}
 
-Availablility
-=============
+Availability
+============
 
 `deep_merge` was written by Steve Midgley, and is now maintained by Daniel DeLeo. The official home of `deep_merge` on the internet is now https://github.com/danielsdeleo/deep_merge
 

data/lib/puppet/vendor/pathspec/lib/pathspec/gitignorespec.rb

@@ -60,7 +60,7 @@ class GitIgnoreSpec < RegexSpec
         pattern_segs.shift
       else
         # A pattern without a beginning slash ('/') will match any
-        # descendant path. This is equivilent to "**/{pattern}". So,
+        # descendant path. This is equivalent to "**/{pattern}". So,
         # prepend with double-asterisks to make pattern relative to
         # root.
         if pattern_segs.length == 1 && pattern_segs[0] != '**'
@@ -70,7 +70,7 @@ class GitIgnoreSpec < RegexSpec
 
       # A pattern ending with a slash ('/') will match all descendant
       # paths of if it is a directory but not if it is a regular file.
-      # This is equivilent to "{pattern}/**". So, set last segment to
+      # This is equivalent to "{pattern}/**". So, set last segment to
       # double asterisks to include all descendants.
       if pattern_segs[-1].empty?
         pattern_segs[-1] = '**'
@@ -185,13 +185,13 @@ class GitIgnoreSpec < RegexSpec
       elsif char == '?'
         regex += '[^/]'
 
-      # Braket expression wildcard. Except for the beginning
-      # exclamation mark, the whole braket expression can be used
+      # Bracket expression wildcard. Except for the beginning
+      # exclamation mark, the whole bracket expression can be used
       # directly as regex but we have to find where the expression
       # ends.
-      # - "[][!]" matchs ']', '[' and '!'.
-      # - "[]-]" matchs ']' and '-'.
-      # - "[!]a-]" matchs any character except ']', 'a' and '-'.
+      # - "[][!]" matches ']', '[' and '!'.
+      # - "[]-]" matches ']' and '-'.
+      # - "[!]a-]" matches any character except ']', 'a' and '-'.
       elsif char == '['
         j = i
         # Pass brack expression negation.
@@ -199,13 +199,13 @@ class GitIgnoreSpec < RegexSpec
           j += 1
         end
 
-        # Pass first closing braket if it is at the beginning of the
+        # Pass first closing bracket if it is at the beginning of the
         # expression.
         if j < pattern.size && pattern[j].chr == ']'
           j += 1
         end
 
-        # Find closing braket. Stop once we reach the end or find it.
+        # Find closing bracket. Stop once we reach the end or find it.
         while j < pattern.size && pattern[j].chr != ']'
           j += 1
         end
@@ -214,12 +214,12 @@ class GitIgnoreSpec < RegexSpec
         if j < pattern.size
           expr = '['
 
-          # Braket expression needs to be negated.
+          # Bracket expression needs to be negated.
           if pattern[i].chr == '!'
             expr += '^'
             i += 1
 
-          # POSIX declares that the regex braket expression negation
+          # POSIX declares that the regex bracket expression negation
           # "[^...]" is undefined in a glob pattern. Python's
           # `fnmatch.translate()` escapes the caret ('^') as a
           # literal. To maintain consistency with undefined behavior,
@@ -236,26 +236,26 @@ class GitIgnoreSpec < RegexSpec
           end
 
 
-          # Build regex braket expression. Escape slashes so they are
+          # Build regex bracket expression. Escape slashes so they are
           # treated as literal slashes by regex as defined by POSIX.
           expr += pattern[i..j].sub('\\', '\\\\')
 
-          # Add regex braket expression to regex result.
+          # Add regex bracket expression to regex result.
           regex += expr
 
-          # Found end of braket expression. Increment j to be one past
-          # the closing braket:
+          # Found end of bracket expression. Increment j to be one past
+          # the closing bracket:
           #
           #  [...]
           #   ^   ^
           #   i   j
           #
           j += 1
-          # Set i to one past the closing braket.
+          # Set i to one past the closing bracket.
           i = j
 
-        # Failed to find closing braket, treat opening braket as a
-        # braket literal instead of as an expression.
+        # Failed to find closing bracket, treat opening bracket as a
+        # bracket literal instead of as an expression.
         else
           regex += '\['
         end

data/lib/puppet/vendor/pathspec/lib/pathspec.rb

@@ -70,7 +70,7 @@ class PathSpec
   end
 
   def drive_letter_to_path(path)
-    path.gsub(/^([a-zA-z]):\//, '/\1/')
+    path.gsub(/^([a-zA-Z]):\//, '/\1/')
   end
 
   # Generate specs from a filename, such as a .gitignore

data/lib/puppet/version.rb

@@ -6,7 +6,7 @@
 # Raketasks and such to set the version based on the output of `git describe`
 
 module Puppet
-  PUPPETVERSION = '5.0.0'
+  PUPPETVERSION = '6.0.0'
 
   ##
   # version is a public API method intended to always provide a fast and