puppet 6.22.1 → 6.25.1

data/spec/unit/facter_impl_spec.rb

@@ -0,0 +1,31 @@
+require 'spec_helper'
+
+describe 'Puppet::FacterImpl' do
+  subject(:facter_impl) { Puppet::FacterImpl.new }
+
+  it { is_expected.to respond_to(:value) }
+  it { is_expected.to respond_to(:add) }
+
+  describe '.value' do
+    let(:method_name) { :value }
+
+    before { allow(Facter).to receive(method_name) }
+
+    it 'delegates to Facter API' do
+      facter_impl.value('test_fact')
+      expect(Facter).to have_received(method_name).with('test_fact')
+    end
+  end
+
+  describe '.add' do
+    let(:block) { Proc.new { setcode 'test' } }
+    let(:method_name) { :add }
+
+    before { allow(Facter).to receive(method_name) }
+
+    it 'delegates to Facter API' do
+      facter_impl.add('test_fact', &block)
+      expect(Facter).to have_received(method_name).with('test_fact', &block)
+    end
+  end
+end

data/spec/unit/file_bucket/dipper_spec.rb

@@ -104,8 +104,8 @@ describe Puppet::FileBucket::Dipper, :uses_checksums => true do
           # Diff without the context
           # Lines we need to see match 'Content' instead of trimming diff output filter out
           # surrounding noise...or hard code the check values
-          if Facter.value(:osfamily) == 'Solaris' &&
-            Puppet::Util::Package.versioncmp(Facter.value(:operatingsystemrelease), '11.0') >= 0
+          if Puppet.runtime[:facter].value(:osfamily) == 'Solaris' &&
+            Puppet::Util::Package.versioncmp(Puppet.runtime[:facter].value(:operatingsystemrelease), '11.0') >= 0
             # Use gdiff on Solaris
             diff12 = Puppet::Util::Execution.execute("gdiff -uN #{file1} #{file2}| grep Content")
             diff21 = Puppet::Util::Execution.execute("gdiff -uN #{file2} #{file1}| grep Content")

data/spec/unit/file_serving/configuration/parser_spec.rb

@@ -155,6 +155,29 @@ describe Puppet::FileServing::Configuration::Parser do
     end
   end
 
+  describe Puppet::FileServing::Configuration::Parser, " when parsing the scripts mount" do
+    include FSConfigurationParserTesting
+
+    before do
+      @mount = double('scriptsmount', :name => "scripts", :validate => true)
+    end
+
+    it "should create an instance of the Scripts Mount class" do
+      write_config_file "[scripts]\n"
+
+      expect(Puppet::FileServing::Mount::Scripts).to receive(:new).with("scripts").and_return(@mount)
+      @parser.parse
+    end
+
+    it "should warn if a path is set" do
+      write_config_file "[scripts]\npath /some/path\n"
+      expect(Puppet::FileServing::Mount::Scripts).to receive(:new).with("scripts").and_return(@mount)
+
+      expect(Puppet).to receive(:warning)
+      @parser.parse
+    end
+  end
+
   describe Puppet::FileServing::Configuration::Parser, " when parsing the plugins mount" do
     include FSConfigurationParserTesting
 

data/spec/unit/file_serving/configuration_spec.rb

@@ -80,15 +80,16 @@ describe Puppet::FileServing::Configuration do
       expect(config.mounted?("one")).to be_truthy
     end
 
-    it "should add modules, plugins, and tasks mounts even if the file does not exist" do
+    it "should add modules, plugins, scripts, and tasks mounts even if the file does not exist" do
       expect(Puppet::FileSystem).to receive(:exist?).and_return(false) # the file doesn't exist
       config = Puppet::FileServing::Configuration.configuration
       expect(config.mounted?("modules")).to be_truthy
       expect(config.mounted?("plugins")).to be_truthy
+      expect(config.mounted?("scripts")).to be_truthy
       expect(config.mounted?("tasks")).to be_truthy
     end
 
-    it "should allow all access to modules, plugins, and tasks if no fileserver.conf exists" do
+    it "should allow all access to modules, plugins, scripts, and tasks if no fileserver.conf exists" do
       expect(Puppet::FileSystem).to receive(:exist?).and_return(false) # the file doesn't exist
       modules = double('modules', :empty? => true)
       allow(Puppet::FileServing::Mount::Modules).to receive(:new).and_return(modules)
@@ -98,6 +99,10 @@ describe Puppet::FileServing::Configuration do
       allow(Puppet::FileServing::Mount::Plugins).to receive(:new).and_return(plugins)
       expect(plugins).to receive(:allow).with('*')
 
+      scripts = double('scripts', :empty? => true)
+      allow(Puppet::FileServing::Mount::Scripts).to receive(:new).and_return(scripts)
+      expect(scripts).to receive(:allow).with('*')
+
       tasks = double('tasks', :empty? => true)
       allow(Puppet::FileServing::Mount::Tasks).to receive(:new).and_return(tasks)
       expect(tasks).to receive(:allow).with('*')
@@ -105,7 +110,7 @@ describe Puppet::FileServing::Configuration do
       Puppet::FileServing::Configuration.configuration
     end
 
-    it "should not allow access from all to modules, plugins, and tasks if the fileserver.conf provided some rules" do
+    it "should not allow access from all to modules, plugins, scripts, and tasks if the fileserver.conf provided some rules" do
       expect(Puppet::FileSystem).to receive(:exist?).and_return(false) # the file doesn't exist
 
       modules = double('modules', :empty? => false)
@@ -116,6 +121,10 @@ describe Puppet::FileServing::Configuration do
       allow(Puppet::FileServing::Mount::Plugins).to receive(:new).and_return(plugins)
       expect(plugins).not_to receive(:allow).with('*')
 
+      scripts = double('scripts', :empty? => false)
+      allow(Puppet::FileServing::Mount::Scripts).to receive(:new).and_return(scripts)
+      expect(scripts).not_to receive(:allow).with('*')
+
       tasks = double('tasks', :empty? => false)
       allow(Puppet::FileServing::Mount::Tasks).to receive(:new).and_return(tasks)
       expect(tasks).not_to receive(:allow).with('*')
@@ -123,12 +132,13 @@ describe Puppet::FileServing::Configuration do
       Puppet::FileServing::Configuration.configuration
     end
 
-    it "should add modules, plugins, and tasks mounts even if they are not returned by the parser" do
+    it "should add modules, plugins, scripts, and tasks mounts even if they are not returned by the parser" do
       expect(@parser).to receive(:parse).and_return("one" => double("mount"))
       expect(Puppet::FileSystem).to receive(:exist?).and_return(true) # the file doesn't exist
       config = Puppet::FileServing::Configuration.configuration
       expect(config.mounted?("modules")).to be_truthy
       expect(config.mounted?("plugins")).to be_truthy
+      expect(config.mounted?("scripts")).to be_truthy
       expect(config.mounted?("tasks")).to be_truthy
     end
   end

data/spec/unit/file_serving/fileset_spec.rb

@@ -46,6 +46,13 @@ describe Puppet::FileServing::Fileset do
       expect(set.recurselimit).to eq(3)
     end
 
+    it "accepts a 'max_files' option" do
+      expect(Puppet::FileSystem).to receive(:lstat).with(somefile).and_return(double('stat'))
+      set = Puppet::FileServing::Fileset.new(somefile, :recurselimit => 3, :max_files => 100)
+      expect(set.recurselimit).to eq(3)
+      expect(set.max_files).to eq(100)
+    end
+
     it "accepts an 'ignore' option" do
       expect(Puppet::FileSystem).to receive(:lstat).with(somefile).and_return(double('stat'))
       set = Puppet::FileServing::Fileset.new(somefile, :ignore => ".svn")
@@ -160,6 +167,29 @@ describe Puppet::FileServing::Fileset do
       end
     end
 
+    def mock_big_dir_structure(path, stat_method = :lstat)
+      allow(Puppet::FileSystem).to receive(stat_method).with(path).and_return(@dirstat)
+
+      # Keep track of the files we're stubbing.
+      @files = %w{.}
+
+      top_names = (1..10).map {|i| "dir_#{i}" }
+      sub_names = (1..100).map {|i| "file__#{i}" }
+
+      allow(Dir).to receive(:entries).with(path, encoding: Encoding::UTF_8).and_return(top_names)
+      top_names.each do |subdir|
+        @files << subdir # relative path
+        subpath = File.join(path, subdir)
+        allow(Puppet::FileSystem).to receive(stat_method).with(subpath).and_return(@dirstat)
+        allow(Dir).to receive(:entries).with(subpath, encoding: Encoding::UTF_8).and_return(sub_names)
+        sub_names.each do |file|
+          @files << File.join(subdir, file) # relative path
+          subfile_path = File.join(subpath, file)
+          allow(Puppet::FileSystem).to receive(stat_method).with(subfile_path).and_return(@filestat)
+        end
+      end
+    end
+
     def setup_mocks_for_dir(mock_dir, base_path)
       path = File.join(base_path, mock_dir.name)
       allow(Puppet::FileSystem).to receive(:lstat).with(path).and_return(MockStat.new(path, true))
@@ -258,6 +288,36 @@ describe Puppet::FileServing::Fileset do
       expect(@fileset.files.find { |file| file.include?("0") }).to be_nil
     end
 
+    it "raises exception if number of files is greater than :max_files" do
+      mock_dir_structure(@path)
+      @fileset.recurse = true
+      @fileset.max_files = 22
+      expect { @fileset.files }.to raise_error(Puppet::Error, "The directory '#{@path}' contains 28 entries, which exceeds the limit of 22 specified by the max_files parameter for this resource. The limit may be increased, but be aware that large number of file resources can result in excessive resource consumption and degraded performance. Consider using an alternate method to manage large directory trees")
+    end
+
+    it "logs a warning if number of files is greater than soft max_files limit of 1000" do
+      mock_big_dir_structure(@path)
+      @fileset.recurse = true
+      expect(Puppet).to receive(:warning).with("The directory '#{@path}' contains 1010 entries, which exceeds the default soft limit 1000 and may cause excessive resource consumption and degraded performance. To remove this warning set a value for `max_files` parameter or consider using an alternate method to manage large directory trees")
+      expect { @fileset.files }.to_not raise_error
+    end
+
+    it "does not emit a warning if max_files is -1" do
+      mock_big_dir_structure(@path)
+      @fileset.recurse = true
+      @fileset.max_files = -1
+      expect(Puppet).to receive(:warning).never
+      @fileset.files
+    end
+
+    it "does not emit a warning if max_files is `-1`(string)" do
+      mock_big_dir_structure(@path)
+      @fileset.recurse = true
+      @fileset.max_files = '-1'
+      expect(Puppet).to receive(:warning).never
+      @fileset.files
+    end
+
     it "ignores files that match a pattern given as a boolean" do
       mock_dir_structure(@path)
       @fileset.recurse = true

data/spec/unit/file_serving/mount/scripts_spec.rb

@@ -0,0 +1,69 @@
+require 'spec_helper'
+require 'puppet/file_serving/mount/scripts'
+
+describe Puppet::FileServing::Mount::Scripts do
+  before do
+    @mount = Puppet::FileServing::Mount::Scripts.new("scripts")
+
+    @environment = double('environment', :module => nil)
+    @request = double('request', :environment => @environment)
+  end
+
+  describe "when finding files" do
+    it "should fail if no module is specified" do
+      expect { @mount.find("", @request) }.to raise_error(/No module specified/)
+    end
+
+    it "should use the provided environment to find the module" do
+      expect(@environment).to receive(:module)
+
+      @mount.find("foo", @request)
+    end
+
+    it "should treat the first field of the relative path as the module name" do
+      expect(@environment).to receive(:module).with("foo")
+      @mount.find("foo/bar/baz", @request)
+    end
+
+    it "should return nil if the specified module does not exist" do
+      expect(@environment).to receive(:module).with("foo")
+      @mount.find("foo/bar/baz", @request)
+    end
+
+    it "should return the file path from the module" do
+      mod = double('module')
+      expect(mod).to receive(:script).with("bar/baz").and_return("eh")
+      expect(@environment).to receive(:module).with("foo").and_return(mod)
+      expect(@mount.find("foo/bar/baz", @request)).to eq("eh")
+    end
+  end
+
+  describe "when searching for files" do
+    it "should fail if no module is specified" do
+      expect { @mount.search("", @request) }.to raise_error(/No module specified/)
+    end
+
+    it "should use the node's environment to search the module" do
+      expect(@environment).to receive(:module)
+
+      @mount.search("foo", @request)
+    end
+
+    it "should treat the first field of the relative path as the module name" do
+      expect(@environment).to receive(:module).with("foo")
+      @mount.search("foo/bar/baz", @request)
+    end
+
+    it "should return nil if the specified module does not exist" do
+      expect(@environment).to receive(:module).with("foo").and_return(nil)
+      @mount.search("foo/bar/baz", @request)
+    end
+
+    it "should return the script path as an array from the module" do
+      mod = double('module')
+      expect(mod).to receive(:script).with("bar/baz").and_return("eh")
+      expect(@environment).to receive(:module).with("foo").and_return(mod)
+      expect(@mount.search("foo/bar/baz", @request)).to eq(["eh"])
+    end
+  end
+end

data/spec/unit/file_system_spec.rb

@@ -290,6 +290,19 @@ describe "Puppet::FileSystem" do
         expect(Puppet::FileSystem.read_preserve_line_endings(file)).to eq("file content \r\nsecond line \n")
       end
     end
+
+    it "should ignore leading BOM" do
+      with_file_content("\uFEFFfile content \n") do |file|
+        expect(Puppet::FileSystem.read_preserve_line_endings(file)).to eq("file content \n")
+      end
+    end
+
+    it "should not warn about misusage of BOM with non-UTF encoding" do
+      allow(Encoding).to receive(:default_external).and_return(Encoding::US_ASCII)
+      with_file_content("file content \n") do |file|
+        expect{ Puppet::FileSystem.read_preserve_line_endings(file) }.not_to output(/BOM with non-UTF encoding US-ASCII is nonsense/).to_stderr
+      end
+    end
   end
 
   context "read without an encoding specified" do

data/spec/unit/functions/assert_type_spec.rb

@@ -28,7 +28,7 @@ describe 'the assert_type function' do
   it 'checks that first argument is a type' do
     expect do
       func.call({}, 10, 10)
-    end.to raise_error(ArgumentError, "'assert_type' expects one of:
+    end.to raise_error(ArgumentError, "The function 'assert_type' was called with arguments it does not accept. It expects one of:
   (Type type, Any value, Callable[Type, Type] block?)
     rejected: parameter 'type' expects a Type value, got Integer
   (String type_string, Any value, Callable[Type, Type] block?)

data/spec/unit/functions/empty_spec.rb

@@ -56,6 +56,16 @@ describe 'the empty function' do
     end
   end
 
+  context 'for a sensitive string it' do
+    it 'returns true when empty' do
+      expect(compile_to_catalog("notify { String(empty(Sensitive(''))): }")).to have_resource('Notify[true]')
+    end
+
+    it 'returns false when not empty' do
+      expect(compile_to_catalog("notify { String(empty(Sensitive(' '))): }")).to have_resource('Notify[false]')
+    end
+  end
+
   context 'for a binary it' do
     it 'returns true when empty' do
       expect(compile_to_catalog("notify { String(empty(Binary(''))): }")).to have_resource('Notify[true]')

data/spec/unit/functions/logging_spec.rb

@@ -6,6 +6,7 @@ describe 'the log function' do
 
   def collect_logs(code)
     Puppet[:code] = code
+    Puppet[:environment_timeout] = 10
     node = Puppet::Node.new('logtest')
     compiler = Puppet::Parser::Compiler.new(node)
     node.environment.check_for_reparse

data/spec/unit/functions/lookup_spec.rb

@@ -870,6 +870,46 @@ describe "The lookup function" do
       end
     end
 
+    context 'with lookup_options' do
+      let(:environment_files) do
+        {
+          env_name => {
+            'hiera.yaml' => <<-YAML.unindent,
+              ---
+              version: 5
+              YAML
+            'data' => {
+              'common.yaml' => common_yaml
+            }
+          }
+        }
+      end
+
+      context 'that are empty' do
+        let(:common_yaml) { <<-YAML.unindent }
+          lookup_options:
+          a: b
+          YAML
+
+        it 'ignores empty options' do
+          expect(lookup('a')).to eq("b")
+        end
+      end
+
+      context 'that contains a legal yaml hash with unexpected types' do
+        let(:common_yaml) { <<-YAML.unindent }
+          lookup_options:
+            :invalid_symbol
+          YAML
+
+        it 'fails lookup and reports a type mismatch' do
+          expect {
+            lookup('a')
+          }.to raise_error(Puppet::DataBinding::LookupError, /has wrong type, expects Puppet::LookupValue, got Runtime\[ruby, 'Symbol'\]/)
+        end
+      end
+    end
+
     context 'with lookup_options configured using patterns' do
       let(:mod_common) {
         <<-YAML.unindent
@@ -1019,6 +1059,30 @@ describe "The lookup function" do
         })
       end
 
+      context 'and lookup_options is empty' do
+        let(:mod_common) { <<-YAML.unindent }
+          lookup_options:
+          mod::a: b
+          YAML
+
+        it 'ignores empty options' do
+          expect(lookup('mod::a')).to eq("b")
+        end
+      end
+
+      context 'and lookup_options contains a legal hash with unexpected types' do
+        let(:mod_common) { <<-YAML.unindent }
+          lookup_options:
+            :invalid_symbol
+          YAML
+
+        it 'fails lookup and reports a type mismatch' do
+          expect {
+            lookup('mod::a')
+          }.to raise_error(Puppet::DataBinding::LookupError, /has wrong type, expects Puppet::LookupValue, got Runtime\[ruby, 'Symbol'\]/)
+        end
+      end
+
       context 'and patterns in module are not limited to module keys' do
         let(:mod_common) {
           <<-YAML.unindent

data/spec/unit/functions/unwrap_spec.rb

@@ -15,6 +15,14 @@ describe 'the unwrap function' do
     expect(eval_and_collect_notices(code)).to eq(['unwrapped value is 12345'])
   end
 
+  it 'just returns a non-sensitive value' do
+    code = <<-CODE
+      $non_sensitive = "12345"
+      notice("value is still ${non_sensitive.unwrap}")
+    CODE
+    expect(eval_and_collect_notices(code)).to eq(['value is still 12345'])
+  end
+
   it 'unwraps a sensitive value when given a code block' do
     code = <<-CODE
       $sensitive = Sensitive.new("12345")

data/spec/unit/functions4_spec.rb

@@ -160,7 +160,7 @@ describe 'the 4x function api' do
       expect(func.is_a?(Puppet::Functions::Function)).to be_truthy
       expect do
         func.call({}, 3, 10, 3, "4")
-      end.to raise_error(ArgumentError, "'min' expects one of:
+      end.to raise_error(ArgumentError, "The function 'min' was called with arguments it does not accept. It expects one of:
   (Numeric x, Numeric y, Numeric a?, Numeric b?, Numeric c*)
     rejected: parameter 'b' expects a Numeric value, got String
   (String x, String y, String a+)
@@ -231,7 +231,7 @@ describe 'the 4x function api' do
       expect(func.is_a?(Puppet::Functions::Function)).to be_truthy
       expect do
         func.call({}, 10, '20')
-      end.to raise_error(ArgumentError, "'min' expects one of:
+      end.to raise_error(ArgumentError, "The function 'min' was called with arguments it does not accept. It expects one of:
   (Numeric a, Numeric b)
     rejected: parameter 'b' expects a Numeric value, got String
   (String s1, String s2)

data/spec/unit/gettext/config_spec.rb

@@ -27,6 +27,18 @@ describe Puppet::GettextConfig do
     Puppet::GettextConfig.delete_all_text_domains
   end
 
+  # These tests assume gettext is enabled, but it will be disabled when the
+  # first time the `Puppet[:disable_i18n]` setting is resolved
+  around(:each) do |example|
+    disabled = Puppet::GettextConfig.instance_variable_get(:@gettext_disabled)
+    Puppet::GettextConfig.instance_variable_set(:@gettext_disabled, false)
+    begin
+      example.run
+    ensure
+      Puppet::GettextConfig.instance_variable_set(:@gettext_disabled, disabled)
+    end
+  end
+
   describe 'setting and getting the locale' do
     it 'should return "en" when gettext is unavailable' do
       allow(Puppet::GettextConfig).to receive(:gettext_loaded?).and_return(false)

data/spec/unit/http/client_spec.rb

@@ -597,11 +597,68 @@ describe Puppet::HTTP::Client do
       expect(response).to be_success
     end
 
-    it "preserves basic authorization" do
+    it "does not preserve basic authorization when redirecting to different hosts" do
+      stub_request(:get, start_url).with(basic_auth: credentials).to_return(redirect_to(url: other_host))
+      stub_request(:get, other_host).to_return(status: 200)
+
+      client.get(start_url, options: {basic_auth: {user: 'user', password: 'pass'}})
+      expect(a_request(:get, other_host).
+      with{ |req| !req.headers.key?('Authorization')}).to have_been_made
+    end
+
+    it "does preserve basic authorization when redirecting to the same hosts" do
+      stub_request(:get, start_url).with(basic_auth: credentials).to_return(redirect_to(url: bar_url))
+      stub_request(:get, bar_url).with(basic_auth: credentials).to_return(status: 200)
+
+      client.get(start_url, options: {basic_auth: {user: 'user', password: 'pass'}})
+      expect(a_request(:get, bar_url).
+      with{ |req| req.headers.key?('Authorization')}).to have_been_made
+    end
+
+    it "does not preserve cookie header when redirecting to different hosts" do
+      headers = { 'Cookie' => 'TEST_COOKIE'}
+
+      stub_request(:get, start_url).with(headers: headers).to_return(redirect_to(url: other_host))
+      stub_request(:get, other_host).to_return(status: 200)
+
+      client.get(start_url, headers: headers)
+      expect(a_request(:get, other_host).
+      with{ |req| !req.headers.key?('Cookie')}).to have_been_made
+    end
+
+    it "does preserve cookie header when redirecting to the same hosts" do
+      headers = { 'Cookie' => 'TEST_COOKIE'}
+
+      stub_request(:get, start_url).with(headers: headers).to_return(redirect_to(url: bar_url))
+      stub_request(:get, bar_url).with(headers: headers).to_return(status: 200)
+
+      client.get(start_url, headers: headers)
+      expect(a_request(:get, bar_url).
+      with{ |req| req.headers.key?('Cookie')}).to have_been_made
+    end
+
+    it "does preserves cookie header and basic authentication when Puppet[:location_trusted] is true redirecting to different hosts" do
+      headers = { 'cookie' => 'TEST_COOKIE'}
+      Puppet[:location_trusted] = true
+
+      stub_request(:get, start_url).with(headers: headers, basic_auth: credentials).to_return(redirect_to(url: other_host))
+      stub_request(:get, other_host).with(headers: headers, basic_auth: credentials).to_return(status: 200)
+
+      client.get(start_url, headers: headers, options: {basic_auth: {user: 'user', password: 'pass'}})
+      expect(a_request(:get, other_host).
+      with{ |req| req.headers.key?('Authorization') && req.headers.key?('Cookie')}).to have_been_made
+    end
+
+    it "treats hosts as case-insensitive" do
+      start_url = URI("https://www.EXAmple.com:8140/Start")
+      bar_url = "https://www.example.com:8140/bar"
+
       stub_request(:get, start_url).with(basic_auth: credentials).to_return(redirect_to(url: bar_url))
       stub_request(:get, bar_url).with(basic_auth: credentials).to_return(status: 200)
 
       client.get(start_url, options: {basic_auth: {user: 'user', password: 'pass'}})
+      expect(a_request(:get, bar_url).
+      with{ |req| req.headers.key?('Authorization')}).to have_been_made
     end
 
     it "redirects given a relative location" do