puppet 6.16.0 → 7.0.0

data/spec/unit/file_system/uniquefile_spec.rb

@@ -84,6 +84,24 @@ describe Puppet::FileSystem::Uniquefile do
     }.to raise_error(Errno::ENOENT, %r{No such file or directory - A directory component in .* does not exist or is a dangling symbolic link})
   end
 
+  it "should use UTF8 characters in TMP,TEMP,TMPDIR environment variable", :if => Puppet::Util::Platform.windows? do
+    rune_utf8 = "\u16A0\u16C7\u16BB\u16EB\u16D2\u16E6\u16A6\u16EB\u16A0\u16B1\u16A9\u16A0\u16A2\u16B1\u16EB\u16A0\u16C1\u16B1\u16AA\u16EB\u16B7\u16D6\u16BB\u16B9\u16E6\u16DA\u16B3\u16A2\u16D7"
+    temp_rune_utf8 = File.join(Dir.tmpdir, rune_utf8)
+    Puppet::FileSystem.mkpath(temp_rune_utf8)
+
+    # Set the temporary environment variables to the UTF8 temp path
+    Puppet::Util::Windows::Process.set_environment_variable('TMPDIR', temp_rune_utf8)
+    Puppet::Util::Windows::Process.set_environment_variable('TMP', temp_rune_utf8)
+    Puppet::Util::Windows::Process.set_environment_variable('TEMP', temp_rune_utf8)
+
+    # Create a unique file
+    filename = Puppet::FileSystem::Uniquefile.open_tmp('foo') do |file|
+      File.dirname(file.path)
+    end
+
+    expect(filename).to eq(temp_rune_utf8)
+  end
+
   context "Ruby 1.9.3 Tempfile tests" do
     # the remaining tests in this file are ported directly from the ruby 1.9.3 source,
     # since most of this file was ported from there

data/spec/unit/file_system_spec.rb

@@ -872,8 +872,7 @@ describe "Puppet::FileSystem" do
 
             # regardless of slash direction, return value is drive letter
             expanded = Puppet::FileSystem.expand_path(slash)
-            expect(expanded).to eq(ENV['SystemDrive'] + File::SEPARATOR)
-            expect(expanded).to eq(File.expand_path(slash))
+            expect(expanded).to match(/^[a-z]:/i)
           end
         end
 

data/spec/unit/functions/camelcase_spec.rb

@@ -15,7 +15,7 @@ describe 'the camelcase function' do
     expect(compile_to_catalog("notify { String(42.camelcase == 42): }")).to have_resource('Notify[true]')
   end
 
-  it 'performs capitalize of international UTF-8 characters', :if => RUBY_VERSION >= "2.4" do
+  it 'performs camelcase of international UTF-8 characters' do
     expect(compile_to_catalog("notify { 'åäö_äö'.camelcase: }")).to have_resource('Notify[ÅäöÄö]')
   end
 

data/spec/unit/functions/capitalize_spec.rb

@@ -15,7 +15,7 @@ describe 'the capitalize function' do
     expect(compile_to_catalog("notify { String(42.capitalize == 42): }")).to have_resource('Notify[true]')
   end
 
-  it 'performs capitalize of international UTF-8 characters', :if => RUBY_VERSION >= "2.4" do
+  it 'performs capitalize of international UTF-8 characters' do
     expect(compile_to_catalog("notify { 'åäö'.capitalize: }")).to have_resource('Notify[Åäö]')
   end
 

data/spec/unit/functions/downcase_spec.rb

@@ -15,7 +15,7 @@ describe 'the downcase function' do
     expect(compile_to_catalog("notify { String(42.downcase == 42): }")).to have_resource('Notify[true]')
   end
 
-  it 'performs capitalize of international UTF-8 characters', :if => RUBY_VERSION >= "2.4" do
+  it 'performs downcase of international UTF-8 characters' do
     expect(compile_to_catalog("notify { 'ÅÄÖ'.downcase: }")).to have_resource('Notify[åäö]')
   end
 

data/spec/unit/functions/inline_epp_spec.rb

@@ -1,8 +1,10 @@
-
 require 'spec_helper'
 
+require 'puppet_spec/compiler'
+
 describe "the inline_epp function" do
   include PuppetSpec::Files
+  include PuppetSpec::Compiler
 
   let :node     do Puppet::Node.new('localhost') end
   let :compiler do Puppet::Parser::Compiler.new(node) end
@@ -73,6 +75,29 @@ describe "the inline_epp function" do
     expect(eval_template("string was: <%= $string %>")).to eq("string was: the string value")
   end
 
+  context "when using Sensitive" do
+    it "returns an unwrapped sensitive value as a String" do
+      expect(eval_and_collect_notices(<<~END)).to eq(["opensesame"])
+        notice(inline_epp("<%= Sensitive('opensesame').unwrap %>"))
+      END
+    end
+
+    it "rewraps a sensitive value" do
+      # note entire result is redacted, not just sensitive part
+      expect(eval_and_collect_notices(<<~END)).to eq(["Sensitive [value redacted]"])
+        notice(inline_epp("This is sensitive <%= Sensitive('opensesame') %>"))
+      END
+    end
+
+    it "can be double wrapped" do
+      catalog = compile_to_catalog(<<~END)
+        notify { 'title':
+          message => Sensitive(inline_epp("<%= Sensitive('opensesame') %>"))
+        }
+      END
+      expect(catalog.resource(:notify, 'title')['message']).to eq('opensesame')
+    end
+  end
 
   def eval_template_with_args(content, args_hash)
     epp_function.call(scope, content, args_hash)

data/spec/unit/functions/upcase_spec.rb

@@ -15,7 +15,7 @@ describe 'the upcase function' do
     expect(compile_to_catalog("notify { String(42.upcase == 42): }")).to have_resource('Notify[true]')
   end
 
-  it 'performs capitalize of international UTF-8 characters', :if => RUBY_VERSION >= "2.4" do
+  it 'performs upcase of international UTF-8 characters' do
     expect(compile_to_catalog("notify { 'åäö'.upcase: }")).to have_resource('Notify[ÅÄÖ]')
   end
 

data/spec/unit/http/client_spec.rb

@@ -1,5 +1,4 @@
 require 'spec_helper'
-require 'webmock/rspec'
 require 'puppet/http'
 
 describe Puppet::HTTP::Client do
@@ -155,7 +154,7 @@ describe Puppet::HTTP::Client do
       stub_request(:get, uri)
 
       response = client.get(uri)
-      expect(response).to be_an_instance_of(Puppet::HTTP::Response)
+      expect(response).to be_a(Puppet::HTTP::Response)
       expect(response).to be_success
       expect(response.code).to eq(200)
     end
@@ -225,7 +224,7 @@ describe Puppet::HTTP::Client do
       stub_request(:head, uri)
 
       response = client.head(uri)
-      expect(response).to be_an_instance_of(Puppet::HTTP::Response)
+      expect(response).to be_a(Puppet::HTTP::Response)
       expect(response).to be_success
       expect(response.code).to eq(200)
     end
@@ -285,7 +284,7 @@ describe Puppet::HTTP::Client do
       stub_request(:put, uri)
 
       response = client.put(uri, "", headers: {'Content-Type' => 'text/plain'})
-      expect(response).to be_an_instance_of(Puppet::HTTP::Response)
+      expect(response).to be_a(Puppet::HTTP::Response)
       expect(response).to be_success
       expect(response.code).to eq(200)
     end
@@ -354,7 +353,7 @@ describe Puppet::HTTP::Client do
       stub_request(:post, uri)
 
       response = client.post(uri, "", headers: {'Content-Type' => 'text/plain'})
-      expect(response).to be_an_instance_of(Puppet::HTTP::Response)
+      expect(response).to be_a(Puppet::HTTP::Response)
       expect(response).to be_success
       expect(response.code).to eq(200)
     end
@@ -436,7 +435,7 @@ describe Puppet::HTTP::Client do
       stub_request(:delete, uri)
 
       response = client.delete(uri)
-      expect(response).to be_an_instance_of(Puppet::HTTP::Response)
+      expect(response).to be_a(Puppet::HTTP::Response)
       expect(response).to be_success
       expect(response.code).to eq(200)
     end
@@ -507,6 +506,20 @@ describe Puppet::HTTP::Client do
 
       client.get(uri, options: {basic_auth: {user: 'user', password: nil}})
     end
+
+    it 'observes userinfo in the URL' do
+      stub_request(:get, uri).with(basic_auth: credentials)
+
+      client.get(URI("https://user:pass@www.example.com"))
+    end
+
+    it 'prefers explicit basic_auth credentials' do
+      uri = URI("https://ignored_user:ignored_pass@www.example.com")
+
+      stub_request(:get, "https://www.example.com").with(basic_auth: credentials)
+
+      client.get(uri, options: {basic_auth: {user: 'user', password: 'pass'}})
+    end
   end
 
   context "when redirecting" do
@@ -535,10 +548,41 @@ describe Puppet::HTTP::Client do
       expect(response).to be_success
     end
 
-    it "preserves query parameters" do
-      query = { 'debug' => true }
-      stub_request(:get, start_url).with(query: query).to_return(redirect_to(url: bar_url))
-      stub_request(:get, bar_url).with(query: query).to_return(status: 200)
+    it "updates the Host header from the Location host and port" do
+      stub_request(:get, start_url).with(headers: { 'Host' => 'www.example.com:8140' })
+        .to_return(redirect_to(url: other_host))
+      stub_request(:get, other_host).with(headers: { 'Host' => 'other.example.com:8140' })
+        .to_return(status: 200)
+
+      response = client.get(start_url)
+      expect(response).to be_success
+    end
+
+    it "omits the default HTTPS port from the Host header" do
+      stub_request(:get, start_url).with(headers: { 'Host' => 'www.example.com:8140' })
+        .to_return(redirect_to(url: "https://other.example.com/qux"))
+      stub_request(:get, "https://other.example.com/qux").with(headers: { 'Host' => 'other.example.com' })
+        .to_return(status: 200)
+
+      response = client.get(start_url)
+      expect(response).to be_success
+    end
+
+    it "omits the default HTTP port from the Host header" do
+      stub_request(:get, start_url).with(headers: { 'Host' => 'www.example.com:8140' })
+        .to_return(redirect_to(url: "http://other.example.com/qux"))
+      stub_request(:get, "http://other.example.com/qux").with(headers: { 'Host' => 'other.example.com' })
+        .to_return(status: 200)
+
+      response = client.get(start_url)
+      expect(response).to be_success
+    end
+
+    it "applies query parameters from the location header" do
+      query = { 'redirected' => false }
+
+      stub_request(:get, start_url).with(query: query).to_return(redirect_to(url: "#{bar_url}?redirected=true"))
+      stub_request(:get, bar_url).with(query: {'redirected' => 'true'}).to_return(status: 200)
 
       response = client.get(start_url, params: query)
       expect(response).to be_success
@@ -569,16 +613,27 @@ describe Puppet::HTTP::Client do
       expect(response).to be_success
     end
 
-    it "preserves query parameters given a relative location" do
+    it "applies query parameters from the location header" do
       relative_url = "/people.html"
-      query = { 'debug' => true }
-      stub_request(:get, start_url).with(query: query).to_return(redirect_to(url: relative_url))
-      stub_request(:get, "https://www.example.com:8140/people.html").with(query: query).to_return(status: 200)
+      query = { 'redirected' => false }
+      stub_request(:get, start_url).with(query: query).to_return(redirect_to(url: "#{relative_url}?redirected=true"))
+      stub_request(:get, "https://www.example.com:8140/people.html").with(query: {'redirected' => 'true'}).to_return(status: 200)
 
       response = client.get(start_url, params: query)
       expect(response).to be_success
     end
 
+    it "removes dot segments from a relative location" do
+      # from https://tools.ietf.org/html/rfc3986#section-5.4.2
+      base_url = URI("http://a/b/c/d;p?q")
+      relative_url = "../../../../g"
+      stub_request(:get, base_url).to_return(redirect_to(url: relative_url))
+      stub_request(:get, "http://a/g").to_return(status: 200)
+
+      response = client.get(base_url)
+      expect(response).to be_success
+    end
+
     it "preserves request body for each request" do
       data = 'some data'
       stub_request(:put, start_url).with(body: data).to_return(redirect_to(url: bar_url))
@@ -716,7 +771,7 @@ describe Puppet::HTTP::Client do
     it "should close the connection before sleeping" do
       retry_after('42')
 
-      site = Puppet::Network::HTTP::Site.from_uri(uri)
+      site = Puppet::HTTP::Site.from_uri(uri)
 
       http1 = Net::HTTP.new(site.host, site.port)
       http1.use_ssl = true
@@ -726,8 +781,7 @@ describe Puppet::HTTP::Client do
       http2.use_ssl = true
       allow(http2).to receive(:started?).and_return(true)
 
-
-      pool = Puppet::Network::HTTP::Pool.new(15)
+      pool = Puppet::HTTP::Pool.new(15)
       client = Puppet::HTTP::Client.new(pool: pool)
 
       # The "with_connection" method is required to yield started connections

data/spec/unit/{network/resolver_spec.rb → http/dns_spec.rb}

@@ -1,7 +1,7 @@
 require 'spec_helper'
-require 'puppet/network/resolver'
+require 'puppet/http'
 
-describe Puppet::Network::Resolver do
+describe Puppet::HTTP::DNS do
   before do
     @dns_mock_object = double('dns')
     allow(Resolv::DNS).to receive(:new).and_return(@dns_mock_object)
@@ -26,7 +26,7 @@ describe Puppet::Network::Resolver do
     end
   end
 
-  let(:resolver) { Puppet::Network::Resolver.new }
+  let(:resolver) { described_class.new }
 
   describe 'when the domain is not known' do
     before :each do

data/spec/unit/http/external_client_spec.rb

@@ -9,7 +9,7 @@ class Puppet::HTTP::TestExternal
     @host = host
     @port = port
     @options = options
-    @factory = Puppet::Network::HTTP::Factory.new
+    @factory = Puppet::HTTP::Factory.new
   end
 
   def get(path, headers = {}, options = {})
@@ -27,7 +27,7 @@ class Puppet::HTTP::TestExternal
       request.basic_auth(options[:basic_auth][:user], options[:basic_auth][:password])
     end
 
-    site = Puppet::Network::HTTP::Site.new(@options[:use_ssl] ? 'https' : 'http', @host, @port)
+    site = Puppet::HTTP::Site.new(@options[:use_ssl] ? 'https' : 'http', @host, @port)
     http = @factory.create_connection(site)
     http.start
     begin
@@ -61,7 +61,7 @@ describe Puppet::HTTP::ExternalClient do
       stub_request(:get, uri)
 
       response = client.get(uri)
-      expect(response).to be_an_instance_of(Puppet::HTTP::Response)
+      expect(response).to be_a(Puppet::HTTP::Response)
       expect(response).to be_success
       expect(response.code).to eq(200)
     end
@@ -113,7 +113,7 @@ describe Puppet::HTTP::ExternalClient do
       stub_request(:post, uri)
 
       response = client.post(uri, "", headers: {'Content-Type' => 'text/plain'})
-      expect(response).to be_an_instance_of(Puppet::HTTP::Response)
+      expect(response).to be_a(Puppet::HTTP::Response)
       expect(response).to be_success
       expect(response.code).to eq(200)
     end

data/spec/unit/{network/http → http}/factory_spec.rb

@@ -1,22 +1,16 @@
 require 'spec_helper'
-require 'puppet/network/http'
-require 'puppet/util/http_proxy'
+require 'puppet/http'
 
-describe Puppet::Network::HTTP::Factory do
+describe Puppet::HTTP::Factory do
   before(:all) do
     ENV['http_proxy'] = nil
     ENV['HTTP_PROXY'] = nil
   end
-  before :each do
-    Puppet::SSL::Key.indirection.terminus_class = :memory
-    Puppet::SSL::CertificateRequest.indirection.terminus_class = :memory
-  end
 
-  let(:site) { Puppet::Network::HTTP::Site.new('https', 'www.example.com', 443) }
+  let(:site) { Puppet::HTTP::Site.new('https', 'www.example.com', 443) }
 
   def create_connection(site)
-    factory = Puppet::Network::HTTP::Factory.new
-
+    factory = described_class.new
     factory.create_connection(site)
   end
 
@@ -124,7 +118,7 @@ describe Puppet::Network::HTTP::Factory do
     expect(conn.keep_alive_timeout).to eq(2147483647)
   end
 
-  it "disables ruby's max retry on 2.5 and up", if: RUBY_VERSION.to_f >= 2.5 do
+  it "disables ruby's max retry" do
     conn = create_connection(site)
 
     expect(conn.max_retries).to eq(0)

data/spec/unit/{network/http/session_spec.rb → http/pool_entry_spec.rb}

@@ -1,15 +1,15 @@
 require 'spec_helper'
 
-require 'puppet/network/http'
+require 'puppet/http'
 
-describe Puppet::Network::HTTP::Session do
+describe Puppet::HTTP::PoolEntry do
   let(:connection) { double('connection') }
   let(:verifier) { double('verifier') }
 
   def create_session(connection, expiration_time = nil)
     expiration_time ||= Time.now + 60 * 60
 
-    Puppet::Network::HTTP::Session.new(connection, verifier, expiration_time)
+    described_class.new(connection, verifier, expiration_time)
   end
 
   it 'provides access to its connection' do

data/spec/unit/{network/http → http}/pool_spec.rb

@@ -4,18 +4,13 @@ require 'openssl'
 require 'puppet/network/http'
 require 'puppet/network/http_pool'
 
-describe Puppet::Network::HTTP::Pool do
-  before :each do
-    Puppet::SSL::Key.indirection.terminus_class = :memory
-    Puppet::SSL::CertificateRequest.indirection.terminus_class = :memory
-  end
-
+describe Puppet::HTTP::Pool do
   let(:site) do
-    Puppet::Network::HTTP::Site.new('https', 'rubygems.org', 443)
+    Puppet::HTTP::Site.new('https', 'rubygems.org', 443)
   end
 
   let(:different_site) do
-    Puppet::Network::HTTP::Site.new('https', 'github.com', 443)
+    Puppet::HTTP::Site.new('https', 'github.com', 443)
   end
 
   let(:ssl_context) { Puppet::SSL::SSLContext.new }
@@ -26,11 +21,11 @@ describe Puppet::Network::HTTP::Pool do
   end
 
   def create_pool
-    Puppet::Network::HTTP::Pool.new(15)
+    Puppet::HTTP::Pool.new(15)
   end
 
   def create_pool_with_connections(site, *connections)
-    pool = Puppet::Network::HTTP::Pool.new(15)
+    pool = Puppet::HTTP::Pool.new(15)
     connections.each do |conn|
       pool.release(site, verifier, conn)
     end
@@ -38,7 +33,7 @@ describe Puppet::Network::HTTP::Pool do
   end
 
   def create_pool_with_http_connections(site, *connections)
-    pool = Puppet::Network::HTTP::Pool.new(15)
+    pool = Puppet::HTTP::Pool.new(15)
     connections.each do |conn|
       pool.release(site, nil, conn)
     end
@@ -48,7 +43,7 @@ describe Puppet::Network::HTTP::Pool do
   def create_pool_with_expired_connections(site, *connections)
     # setting keepalive timeout to -1 ensures any newly added
     # connections have already expired
-    pool = Puppet::Network::HTTP::Pool.new(-1)
+    pool = Puppet::HTTP::Pool.new(-1)
     connections.each do |conn|
       pool.release(site, verifier, conn)
     end
@@ -230,11 +225,11 @@ describe Puppet::Network::HTTP::Pool do
     end
 
     it 'returns a new HTTP connection if the cached connection is HTTPS' do
-      https_site = Puppet::Network::HTTP::Site.new('https', 'www.example.com', 443)
+      https_site = Puppet::HTTP::Site.new('https', 'www.example.com', 443)
       old_conn = create_connection(https_site)
       pool = create_pool_with_connections(https_site, old_conn)
 
-      http_site = Puppet::Network::HTTP::Site.new('http', 'www.example.com', 443)
+      http_site = Puppet::HTTP::Site.new('http', 'www.example.com', 443)
       new_conn = create_http_connection(http_site)
       allow(pool.factory).to receive(:create_connection).with(http_site).and_return(new_conn)
 
@@ -242,11 +237,11 @@ describe Puppet::Network::HTTP::Pool do
     end
 
     it 'returns a new HTTPS connection if the cached connection is HTTP' do
-      http_site = Puppet::Network::HTTP::Site.new('http', 'www.example.com', 443)
+      http_site = Puppet::HTTP::Site.new('http', 'www.example.com', 443)
       old_conn = create_http_connection(http_site)
       pool = create_pool_with_http_connections(http_site, old_conn)
 
-      https_site = Puppet::Network::HTTP::Site.new('https', 'www.example.com', 443)
+      https_site = Puppet::HTTP::Site.new('https', 'www.example.com', 443)
       new_conn = create_connection(https_site)
       allow(pool.factory).to receive(:create_connection).with(https_site).and_return(new_conn)
 
@@ -279,7 +274,7 @@ describe Puppet::Network::HTTP::Pool do
     end
 
     it 'returns a cached connection if both connections are http' do
-      http_site = Puppet::Network::HTTP::Site.new('http', 'www.example.com', 80)
+      http_site = Puppet::HTTP::Site.new('http', 'www.example.com', 80)
       old_conn = create_http_connection(http_site)
       pool = create_pool_with_http_connections(http_site, old_conn)