puppet 5.3.4 → 6.29.0

data/spec/unit/util/windows/sid_spec.rb

@@ -1,8 +1,7 @@
-#!/usr/bin/env ruby
 require 'spec_helper'
 
-describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows? do
-  if Puppet.features.microsoft_windows?
+describe "Puppet::Util::Windows::SID", :if => Puppet::Util::Platform.windows? do
+  if Puppet::Util::Platform.windows?
     require 'puppet/util/windows'
   end
 
@@ -13,10 +12,10 @@ describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows?
   let(:null_sid)     { 'S-1-0-0' }
   let(:unknown_name) { 'chewbacca' }
 
-  context "#octet_string_to_sid_object" do
+  context "#octet_string_to_principal" do
     it "should properly convert an array of bytes for a well-known non-localized SID" do
       bytes = [1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
-      converted = subject.octet_string_to_sid_object(bytes)
+      converted = subject.octet_string_to_principal(bytes)
 
       expect(converted).to be_an_instance_of Puppet::Util::Windows::SID::Principal
       expect(converted.sid_bytes).to eq(bytes)
@@ -28,13 +27,13 @@ describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows?
 
     it "should raise an error for non-array input" do
       expect {
-        subject.octet_string_to_sid_object(invalid_sid)
+        subject.octet_string_to_principal(invalid_sid)
       }.to raise_error(Puppet::Error, /Octet string must be an array of bytes/)
     end
 
     it "should raise an error for an empty byte array" do
       expect {
-        subject.octet_string_to_sid_object([])
+        subject.octet_string_to_principal([])
       }.to raise_error(Puppet::Error, /Octet string must be an array of bytes/)
     end
 
@@ -42,7 +41,7 @@ describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows?
       expect {
         # S-1-1-1 which is not a valid account
         valid_octet_invalid_user =[1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0]
-        subject.octet_string_to_sid_object(valid_octet_invalid_user)
+        subject.octet_string_to_principal(valid_octet_invalid_user)
       }.to raise_error do |error|
         expect(error).to be_a(Puppet::Util::Windows::Error)
         expect(error.code).to eq(1332) # ERROR_NONE_MAPPED
@@ -52,7 +51,7 @@ describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows?
     it "should raise an error for a malformed byte array" do
       expect {
         invalid_octet = [2]
-        subject.octet_string_to_sid_object(invalid_octet)
+        subject.octet_string_to_principal(invalid_octet)
       }.to raise_error do |error|
         expect(error).to be_a(Puppet::Util::Windows::Error)
         expect(error.code).to eq(87) # ERROR_INVALID_PARAMETER
@@ -72,12 +71,12 @@ describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows?
     end
 
     it "should return a SID for a passed user or group name" do
-      subject.expects(:name_to_sid_object).with('testers').returns stub(:sid => 'S-1-5-32-547')
+      expect(subject).to receive(:name_to_principal).with('testers').and_return(double(:sid => 'S-1-5-32-547'))
       expect(subject.name_to_sid('testers')).to eq('S-1-5-32-547')
     end
 
     it "should return a SID for a passed fully-qualified user or group name" do
-      subject.expects(:name_to_sid_object).with('MACHINE\testers').returns stub(:sid => 'S-1-5-32-547')
+      expect(subject).to receive(:name_to_principal).with('MACHINE\testers').and_return(double(:sid => 'S-1-5-32-547'))
       expect(subject.name_to_sid('MACHINE\testers')).to eq('S-1-5-32-547')
     end
 
@@ -100,7 +99,6 @@ describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows?
     end
 
     describe "with non-US languages" do
-
       UMLAUT = [195, 164].pack('c*').force_encoding(Encoding::UTF_8)
       let(:username) { SecureRandom.uuid.to_s.gsub(/\-/, '')[0..13] + UMLAUT }
 
@@ -128,37 +126,149 @@ describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows?
     end
   end
 
-  context "#name_to_sid_object" do
+  context "#name_to_principal" do
     it "should return nil if the account does not exist" do
-      expect(subject.name_to_sid_object(unknown_name)).to be_nil
+      expect(subject.name_to_principal(unknown_name)).to be_nil
+    end
+
+    it "should print a debug message if the account does not exist" do
+      expect(Puppet).to receive(:debug).with(/No mapping between account names and security IDs was done/)
+      subject.name_to_principal(unknown_name)
     end
 
     it "should return a Puppet::Util::Windows::SID::Principal instance for any valid sid" do
-      expect(subject.name_to_sid_object(sid)).to be_an_instance_of(Puppet::Util::Windows::SID::Principal)
+      expect(subject.name_to_principal(sid)).to be_an_instance_of(Puppet::Util::Windows::SID::Principal)
+    end
+
+    it "should not print debug messages for valid sid" do
+      expect(Puppet).not_to receive(:debug).with(/Could not retrieve raw SID bytes from/)
+      expect(Puppet).not_to receive(:debug).with(/No mapping between account names and security IDs was done/)
+      subject.name_to_principal(sid)
+    end
+
+    it "should print a debug message for invalid sid" do
+      expect(Puppet).not_to receive(:debug).with(/Could not retrieve raw SID bytes from/)
+      expect(Puppet).to receive(:debug).with(/No mapping between account names and security IDs was done/)
+      subject.name_to_principal('S-1-5-21-INVALID-SID')
     end
 
     it "should accept unqualified account name" do
       # NOTE: lookup by name works in localized environments only for a few instances
       # this works in French Windows, even though the account is really Syst\u00E8me
-      expect(subject.name_to_sid_object('SYSTEM').sid).to eq(sid)
+      expect(subject.name_to_principal('SYSTEM').sid).to eq(sid)
+    end
+
+    it "should not print debug messages for unqualified account name" do
+      expect(Puppet).not_to receive(:debug).with(/Could not retrieve raw SID bytes from/)
+      expect(Puppet).not_to receive(:debug).with(/No mapping between account names and security IDs was done/)
+      subject.name_to_principal('SYSTEM')
     end
 
     it "should be case-insensitive" do
       # NOTE: lookup by name works in localized environments only for a few instances
       # this works in French Windows, even though the account is really Syst\u00E8me
-      expect(subject.name_to_sid_object('SYSTEM')).to eq(subject.name_to_sid_object('system'))
+      expect(subject.name_to_principal('SYSTEM')).to eq(subject.name_to_principal('system'))
+    end
+
+    it "should not print debug messages for wrongly cased account name" do
+      expect(Puppet).not_to receive(:debug).with(/Could not retrieve raw SID bytes from/)
+      expect(Puppet).not_to receive(:debug).with(/No mapping between account names and security IDs was done/)
+      subject.name_to_principal('system')
     end
 
     it "should be leading and trailing whitespace-insensitive" do
       # NOTE: lookup by name works in localized environments only for a few instances
       # this works in French Windows, even though the account is really Syst\u00E8me
-      expect(subject.name_to_sid_object('SYSTEM')).to eq(subject.name_to_sid_object(' SYSTEM '))
+      expect(subject.name_to_principal('SYSTEM')).to eq(subject.name_to_principal(' SYSTEM '))
+    end
+
+    it "should not print debug messages for account name with leading and trailing whitespace" do
+      expect(Puppet).not_to receive(:debug).with(/Could not retrieve raw SID bytes from/)
+      expect(Puppet).not_to receive(:debug).with(/No mapping between account names and security IDs was done/)
+      subject.name_to_principal(' SYSTEM ')
     end
 
     it "should accept domain qualified account names" do
       # NOTE: lookup by name works in localized environments only for a few instances
       # this works in French Windows, even though the account is really AUTORITE NT\\Syst\u00E8me
-      expect(subject.name_to_sid_object('NT AUTHORITY\SYSTEM').sid).to eq(sid)
+      expect(subject.name_to_principal('NT AUTHORITY\SYSTEM').sid).to eq(sid)
+    end
+
+    it "should not print debug messages for domain qualified account names" do
+      expect(Puppet).not_to receive(:debug).with(/Could not retrieve raw SID bytes from/)
+      expect(Puppet).not_to receive(:debug).with(/No mapping between account names and security IDs was done/)
+      subject.name_to_principal('NT AUTHORITY\SYSTEM')
+    end
+  end
+
+  context "#ads_to_principal" do
+    it "should raise an error for non-WIN32OLE input" do
+      expect {
+        subject.ads_to_principal(double('WIN32OLE', { :Name => 'foo' }))
+      }.to raise_error(Puppet::Error, /ads_object must be an IAdsUser or IAdsGroup instance/)
+    end
+
+    it "should raise an error for an empty byte array in the objectSID property" do
+      expect {
+        subject.ads_to_principal(double('WIN32OLE', { :objectSID => [], :Name => '', :ole_respond_to? => true }))
+      }.to raise_error(Puppet::Error, /Octet string must be an array of bytes/)
+    end
+
+    it "should raise an error for a malformed byte array" do
+      expect {
+        invalid_octet = [2]
+        subject.ads_to_principal(double('WIN32OLE', { :objectSID => invalid_octet, :Name => '', :ole_respond_to? => true }))
+      }.to raise_error do |error|
+        expect(error).to be_a(Puppet::Util::Windows::Error)
+        expect(error.code).to eq(87) # ERROR_INVALID_PARAMETER
+      end
+    end
+
+    it "should raise an error when a valid byte array for SID is unresolvable and its Name does not match" do
+      expect {
+        # S-1-1-1 is a valid SID that will not resolve
+        valid_octet_invalid_user = [1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0]
+        subject.ads_to_principal(double('WIN32OLE', { :objectSID => valid_octet_invalid_user, :Name => unknown_name, :ole_respond_to? => true }))
+      }.to raise_error do |error|
+        expect(error).to be_a(Puppet::Error)
+        expect(error.cause.code).to eq(1332) # ERROR_NONE_MAPPED
+      end
+    end
+
+    it "should return a Principal object even when the SID is unresolvable, as long as the Name matches" do
+      # S-1-1-1 is a valid SID that will not resolve
+      valid_octet_invalid_user = [1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0]
+      unresolvable_user = double('WIN32OLE', { :objectSID => valid_octet_invalid_user, :Name => 'S-1-1-1', :ole_respond_to? => true })
+      principal = subject.ads_to_principal(unresolvable_user)
+
+      expect(principal).to be_an_instance_of(Puppet::Util::Windows::SID::Principal)
+      expect(principal.account).to eq('S-1-1-1')
+      expect(principal.domain).to eq(nil)
+      expect(principal.domain_account).to eq('S-1-1-1')
+      expect(principal.sid).to eq('S-1-1-1')
+      expect(principal.sid_bytes).to eq(valid_octet_invalid_user)
+      expect(principal.account_type).to eq(:SidTypeUnknown)
+    end
+
+    it "should return a Puppet::Util::Windows::SID::Principal instance for any valid sid" do
+      system_bytes = [1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0]
+      adsuser = double('WIN32OLE', { :objectSID => system_bytes, :Name => 'SYSTEM', :ole_respond_to? => true })
+      expect(subject.ads_to_principal(adsuser)).to be_an_instance_of(Puppet::Util::Windows::SID::Principal)
+    end
+
+    it "should properly convert an array of bytes for a well-known non-localized SID, ignoring the Name from the WIN32OLE object" do
+      bytes = [1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
+      adsuser = double('WIN32OLE', { :objectSID => bytes, :Name => unknown_name, :ole_respond_to? => true })
+      converted = subject.ads_to_principal(adsuser)
+
+      expect(converted).to be_an_instance_of Puppet::Util::Windows::SID::Principal
+      expect(converted.sid_bytes).to eq(bytes)
+      expect(converted.sid).to eq(null_sid)
+
+      # carefully select a SID here that is not localized on international Windows
+      expect(converted.account).to eq('NULL SID')
+      # garbage name supplied does not carry forward as SID is looked up again
+      expect(converted.account).to_not eq(adsuser.Name)
     end
   end
 
@@ -217,8 +327,8 @@ describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows?
     end
 
     it "should raise if the conversion fails" do
-      subject.expects(:string_to_sid_ptr).with(sid).
-        raises(Puppet::Util::Windows::Error.new("Failed to convert string SID: #{sid}", Puppet::Util::Windows::Error::ERROR_ACCESS_DENIED))
+      expect(subject).to receive(:string_to_sid_ptr).with(sid).
+        and_raise(Puppet::Util::Windows::Error.new("Failed to convert string SID: #{sid}", Puppet::Util::Windows::Error::ERROR_ACCESS_DENIED))
 
       expect {
         subject.string_to_sid_ptr(sid) {|ptr| }

data/spec/unit/util/windows/string_spec.rb

@@ -1,10 +1,9 @@
 # encoding: UTF-8
-#!/usr/bin/env ruby
 
 require 'spec_helper'
 require 'puppet/util/windows'
 
-describe "Puppet::Util::Windows::String", :if => Puppet.features.microsoft_windows? do
+describe "Puppet::Util::Windows::String", :if => Puppet::Util::Platform.windows? do
   UTF16_NULL = [0, 0]
 
   def wide_string(str)

data/spec/unit/util/windows_spec.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Puppet::Util::Windows do
+  %w[
+    ADSI
+    ADSI::ADSIObject
+    ADSI::User
+    ADSI::UserProfile
+    ADSI::Group
+    EventLog
+    File
+    Process
+    Registry
+    Service
+    SID
+    ].each do |name|
+    it "defines Puppet::Util::Windows::#{name}" do
+      expect(described_class.const_get(name)).to be
+    end
+  end
+end

data/spec/unit/util/yaml_spec.rb

@@ -1,5 +1,5 @@
+# coding: utf-8
 require 'spec_helper'
-
 require 'puppet/util/yaml'
 
 describe Puppet::Util::Yaml do
@@ -7,61 +7,220 @@ describe Puppet::Util::Yaml do
 
   let(:filename) { tmpfile("yaml") }
 
-  it "reads a YAML file from disk" do
-    write_file(filename, YAML.dump({ "my" => "data" }))
+  shared_examples_for 'yaml file loader' do |load_method|
+    it 'returns false when the file is empty' do
+      file_path = file_containing('input', '')
 
-    expect(Puppet::Util::Yaml.load_file(filename)).to eq({ "my" => "data" })
-  end
+      expect(load_method.call(file_path)).to eq(false)
+    end
 
-  it "writes data formatted as YAML to disk" do
-    Puppet::Util::Yaml.dump({ "my" => "data" }, filename)
+    it 'reads a YAML file from disk' do
+      file_path = file_containing('input', YAML.dump({ "my" => "data" }))
 
-    expect(Puppet::Util::Yaml.load_file(filename)).to eq({ "my" => "data" })
-  end
+      expect(load_method.call(file_path)).to eq({ "my" => "data" })
+    end
 
-  it "raises an error when the file is invalid YAML" do
-    write_file(filename, "{ invalid")
+    it 'reads YAML as UTF-8' do
+      file_path = file_containing('input', YAML.dump({ "my" => "𠜎" }))
 
-    expect { Puppet::Util::Yaml.load_file(filename) }.to raise_error(Puppet::Util::Yaml::YamlLoadError)
+      expect(load_method.call(file_path)).to eq({ "my" => "𠜎" })
+    end
   end
 
-  it "raises an error when the file does not exist" do
-    expect { Puppet::Util::Yaml.load_file("no") }.to raise_error(Puppet::Util::Yaml::YamlLoadError, /No such file or directory/)
-  end
+  context "#safe_load" do
+    it 'raises an error if YAML is invalid' do
+      expect {
+        Puppet::Util::Yaml.safe_load('{ invalid')
+      }.to raise_error(Puppet::Util::Yaml::YamlLoadError, %r[\(<unknown>\): .* at line \d+ column \d+])
+    end
 
-  it "raises an error when the filename is illegal" do
-    expect { Puppet::Util::Yaml.load_file("not\0allowed") }.to raise_error(Puppet::Util::Yaml::YamlLoadError, /null byte/)
-  end
+    it 'raises if YAML contains classes not in the list' do
+      expect {
+        Puppet::Util::Yaml.safe_load(<<FACTS, [])
+--- !ruby/object:Puppet::Node::Facts
+name: localhost
+FACTS
+      }.to raise_error(Puppet::Util::Yaml::YamlLoadError, "(<unknown>): Tried to load unspecified class: Puppet::Node::Facts")
+    end
+
+    it 'includes the filename if YAML contains classes not in the list' do
+      expect {
+        Puppet::Util::Yaml.safe_load(<<FACTS, [], 'foo.yaml')
+--- !ruby/object:Puppet::Node::Facts
+name: localhost
+FACTS
+      }.to raise_error(Puppet::Util::Yaml::YamlLoadError, "(foo.yaml): Tried to load unspecified class: Puppet::Node::Facts")
+    end
+
+    it 'allows classes to be loaded' do
+      facts = Puppet::Util::Yaml.safe_load(<<FACTS, [Puppet::Node::Facts])
+--- !ruby/object:Puppet::Node::Facts
+name: localhost
+values:
+  puppetversion: 6.0.0
+FACTS
+      expect(facts.name).to eq('localhost')
+    end
+
+    it 'returns false if the content is empty' do
+      expect(Puppet::Util::Yaml.safe_load('')).to eq(false)
+    end
 
-  context "when the file is empty" do
-    it "returns false" do
-      Puppet::FileSystem.touch(filename)
+    it 'loads true' do
+      expect(Puppet::Util::Yaml.safe_load('true')).to eq(true)
+    end
+
+    it 'loads false' do
+      expect(Puppet::Util::Yaml.safe_load('false')).to eq(false)
+    end
+
+    it 'loads nil' do
+      expect(Puppet::Util::Yaml.safe_load(<<~YAML)).to eq('a' => nil)
+        ---
+        a: null
+      YAML
+    end
+
+    it 'loads a numeric' do
+      expect(Puppet::Util::Yaml.safe_load('42')).to eq(42)
+    end
+
+    it 'loads a string' do
+      expect(Puppet::Util::Yaml.safe_load('puppet')).to eq('puppet')
+    end
 
-      expect(Puppet::Util::Yaml.load_file(filename)).to be_falsey
+    it 'loads an array' do
+      expect(Puppet::Util::Yaml.safe_load(<<~YAML)).to eq([1, 2])
+        ---
+        - 1
+        - 2
+      YAML
     end
 
-    it "allows return value to be overridden" do
-      Puppet::FileSystem.touch(filename)
+    it 'loads a hash' do
+      expect(Puppet::Util::Yaml.safe_load(<<~YAML)).to eq('a' => 1, 'b' => 2)
+        ---
+        a: 1
+        b: 2
+      YAML
+    end
 
-      expect(Puppet::Util::Yaml.load_file(filename, {})).to eq({})
+    it 'loads an alias' do
+      expect(Puppet::Util::Yaml.safe_load(<<~YAML)).to eq('a' => [], 'b' => [])
+        ---
+        a: &1 []
+        b: *1
+      YAML
     end
   end
 
-  it "should allow one to strip ruby tags that would otherwise not parse" do
-    write_file(filename, "---\nweirddata: !ruby/hash:Not::A::Valid::Class {}")
+  context "#safe_load_file" do
+    it_should_behave_like 'yaml file loader', Puppet::Util::Yaml.method(:safe_load_file)
+
+    it 'raises an error when the file is invalid YAML' do
+      file_path = file_containing('input', '{ invalid')
+
+      expect {
+        Puppet::Util::Yaml.safe_load_file(file_path)
+      }.to raise_error(Puppet::Util::Yaml::YamlLoadError, %r[\(#{file_path}\): .* at line \d+ column \d+])
+    end
+
+    it 'raises an error when the filename is illegal' do
+      expect {
+        Puppet::Util::Yaml.safe_load_file("not\0allowed")
+      }.to raise_error(ArgumentError, /pathname contains null byte/)
+    end
 
-    expect(Puppet::Util::Yaml.load_file(filename, {}, true)).to eq({"weirddata" => {}})
+    it 'raises an error when the file does not exist' do
+      expect {
+        Puppet::Util::Yaml.safe_load_file('does/not/exist.yaml')
+      }.to raise_error(Errno::ENOENT, /No such file or directory/)
+    end
   end
 
-  it "should not strip non-ruby tags" do
-    write_file(filename, "---\nweirddata: !binary |-\n          e21kNX04MTE4ZGY2NmM5MTc3OTg4ZWE4Y2JiOWEzMjMyNzFkYg==")
+  context "#safe_load_file_if_valid" do
+    before do
+      Puppet[:log_level] = 'debug'
+    end
+
+    it_should_behave_like 'yaml file loader', Puppet::Util::Yaml.method(:safe_load_file_if_valid)
+
+    it 'returns nil when the file is invalid YAML and debug logs about it' do
+      file_path = file_containing('input', '{ invalid')
+
+      expect(Puppet).to receive(:debug)
+        .with(/Could not retrieve YAML content .+ expected ',' or '}'/).and_call_original
+
+      expect(Puppet::Util::Yaml.safe_load_file_if_valid(file_path)).to eql(nil)
+    end
+
+    it 'returns nil when the filename is illegal and debug logs about it' do
+      expect(Puppet).to receive(:debug)
+        .with(/Could not retrieve YAML content .+: pathname contains null byte/).and_call_original
+
+      expect(Puppet::Util::Yaml.safe_load_file_if_valid("not\0allowed")).to eql(nil)
+    end
+
+    it 'returns nil when the file does not exist and debug logs about it' do
+      expect(Puppet).to receive(:debug)
+        .with(/Could not retrieve YAML content .+: No such file or directory/).and_call_original
 
-    expect(Puppet::Util::Yaml.load_file(filename, {}, true)).to eq({"weirddata" => "{md5}8118df66c9177988ea8cbb9a323271db"})
+      expect(Puppet::Util::Yaml.safe_load_file_if_valid('does/not/exist.yaml')).to eql(nil)
+    end
   end
 
-  def write_file(name, contents)
-    File.open(name, "w:UTF-8") do |fh|
-      fh.write(contents)
+  context '#load_file' do
+    it_should_behave_like 'yaml file loader', Puppet::Util::Yaml.method(:load_file)
+
+    it 'raises an error when the file is invalid YAML' do
+      file_path = file_containing('input', '{ invalid')
+
+      expect {
+        Puppet::Util::Yaml.load_file(file_path)
+      }.to raise_error(Puppet::Util::Yaml::YamlLoadError, %r{\(#{file_path}\): .* at line \d+ column \d+})
+    end
+
+    it 'raises an error when the filename is illegal' do
+      expect {
+        Puppet::Util::Yaml.load_file("not\0allowed")
+      }.to raise_error(Puppet::Util::Yaml::YamlLoadError, /null byte/)
+    end
+
+    it 'raises an error when the file does not exist' do
+      expect {
+        Puppet::Util::Yaml.load_file('does/not/exist.yaml')
+      }.to raise_error(Puppet::Util::Yaml::YamlLoadError, /No such file or directory/)
+    end
+
+    it 'allows return value to be overridden' do
+      file_path = file_containing('input', '')
+
+      expect(Puppet::Util::Yaml.load_file(file_path, {})).to eq({})
+    end
+
+    it 'loads arbitrary objects' do
+      file_path = file_containing('input', "--- !ruby/object {}\n")
+
+      expect(Puppet::Util::Yaml.load_file(file_path, {})).to be_instance_of(Object)
+    end
+
+    it 'should allow one to strip ruby tags that would otherwise not parse' do
+     file_path = file_containing('input', "---\nweirddata: !ruby/hash:Not::A::Valid::Class {}")
+
+      expect(Puppet::Util::Yaml.load_file(file_path, {}, true)).to eq({"weirddata" => {}})
+    end
+
+    it 'should not strip non-ruby tags' do
+      file_path = file_containing('input', "---\nweirddata: !binary |-\n          e21kNX04MTE4ZGY2NmM5MTc3OTg4ZWE4Y2JiOWEzMjMyNzFkYg==")
+
+      expect(Puppet::Util::Yaml.load_file(file_path, {}, true)).to eq({"weirddata" => "{md5}8118df66c9177988ea8cbb9a323271db"})
+    end
+
+    it 'writes data formatted as YAML to disk' do
+      file_path = file_containing('input', '')
+      Puppet::Util::Yaml.dump({ "my" => "data" }, file_path)
+
+      expect(Puppet::Util::Yaml.load_file(file_path)).to eq({ "my" => "data" })
     end
   end
 end