puppet 8.4.0 → 8.5.0

data/lib/puppet/util/windows/eventlog.rb

@@ -10,7 +10,7 @@ require 'ffi'
 # - Define Puppet::Util::Windows
 # - Replicate logic that exists elsewhere in puppet/util/windows
 # - Raise generic RuntimeError instead of Puppet::Util::Windows::Error if its not defined
-module Puppet; module Util; module Windows ; end ; end ; end
+module Puppet; module Util; module Windows; end; end; end
 
 class Puppet::Util::Windows::EventLog
   extend FFI::Library
@@ -92,11 +92,11 @@ class Puppet::Util::Windows::EventLog
     # @api public
     def to_native(level)
       case level
-      when :debug,:info,:notice
+      when :debug, :info, :notice
         [EVENTLOG_INFORMATION_TYPE, 0x01]
       when :warning
         [EVENTLOG_WARNING_TYPE, 0x02]
-      when :err,:alert,:emerg,:crit
+      when :err, :alert, :emerg, :crit
         [EVENTLOG_ERROR_TYPE, 0x03]
       else
         raise ArgumentError, _("Invalid log level %{level}") % { level: level }
@@ -119,7 +119,7 @@ class Puppet::Util::Windows::EventLog
     class EventLogError < RuntimeError
       def initialize(msg, code)
         # TRANSLATORS 'Win32' is the Windows API and should not be translated
-        super(msg + ' ' + _("(Win32 error: %{detail})") % { detail: code})
+        super(msg + ' ' + _("(Win32 error: %{detail})") % { detail: code })
       end
     end
   end

data/lib/puppet/util/windows/file.rb

@@ -53,7 +53,8 @@ module Puppet::Util::Windows::File
     return true if result != FFI::WIN32_FALSE
 
     raise Puppet::Util::Windows::Error.new(
-      "CreateSymbolicLink(#{symlink}, #{target}, #{flags.to_s(8)})")
+      "CreateSymbolicLink(#{symlink}, #{target}, #{flags.to_s(8)})"
+    )
   end
   module_function :symlink
 
@@ -67,7 +68,7 @@ module Puppet::Util::Windows::File
       # return false if this path has been seen before.  This is protection against circular symlinks
       return false if seen_paths.include?(path.downcase)
 
-      result = get_attributes(path,false)
+      result = get_attributes(path, false)
 
       # return false for path not found
       return false if result == INVALID_FILE_ATTRIBUTES
@@ -128,7 +129,7 @@ module Puppet::Util::Windows::File
   # define INVALID_HANDLE_VALUE ((HANDLE)(LONG_PTR)-1)
   INVALID_HANDLE_VALUE = FFI::Pointer.new(-1).address
   def self.create_file(file_name, desired_access, share_mode, security_attributes,
-    creation_disposition, flags_and_attributes, template_file_handle)
+                       creation_disposition, flags_and_attributes, template_file_handle)
 
     result = CreateFileW(wide_string(file_name.to_s),
                          desired_access, share_mode, security_attributes, creation_disposition,
@@ -137,9 +138,10 @@ module Puppet::Util::Windows::File
     return result unless result == INVALID_HANDLE_VALUE
 
     raise Puppet::Util::Windows::Error.new(
-      "CreateFile(#{file_name}, #{desired_access.to_s(8)}, #{share_mode.to_s(8)}, " +
-        "#{security_attributes}, #{creation_disposition.to_s(8)}, " +
-        "#{flags_and_attributes.to_s(8)}, #{template_file_handle})")
+      "CreateFile(#{file_name}, #{desired_access.to_s(8)}, #{share_mode.to_s(8)}, " \
+      "#{security_attributes}, #{creation_disposition.to_s(8)}, " \
+      "#{flags_and_attributes.to_s(8)}, #{template_file_handle})"
+    )
   end
 
   def self.get_reparse_point_data(handle, &block)
@@ -156,8 +158,8 @@ module Puppet::Util::Windows::File
                     when IO_REPARSE_TAG_NFS
                       raise Puppet::Util::Windows::Error.new("Retrieving NFS reparse point data is unsupported")
                     else
-                      raise Puppet::Util::Windows::Error.new("DeviceIoControl(#{handle}, " +
-                        "FSCTL_GET_REPARSE_POINT) returned unknown tag 0x#{reparse_tag.to_s(16).upcase}")
+                      raise Puppet::Util::Windows::Error.new("DeviceIoControl(#{handle}, " \
+                                                             "FSCTL_GET_REPARSE_POINT) returned unknown tag 0x#{reparse_tag.to_s(16).upcase}")
                     end
 
       yield buffer_type.new(reparse_data_buffer_ptr)
@@ -198,9 +200,10 @@ module Puppet::Util::Windows::File
 
       if result == FFI::WIN32_FALSE
         raise Puppet::Util::Windows::Error.new(
-          "DeviceIoControl(#{handle}, #{io_control_code}, " +
-          "#{in_buffer}, #{in_buffer ? in_buffer.size : ''}, " +
-          "#{out_buffer}, #{out_buffer ? out_buffer.size : ''}")
+          "DeviceIoControl(#{handle}, #{io_control_code}, " \
+          "#{in_buffer}, #{in_buffer ? in_buffer.size : ''}, " \
+          "#{out_buffer}, #{out_buffer ? out_buffer.size : ''}"
+        )
       end
     end
 
@@ -231,7 +234,8 @@ module Puppet::Util::Windows::File
         nil, # security_attributes
         OPEN_EXISTING,
         FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_BACKUP_SEMANTICS,
-        0) # template_file
+        0
+      ) # template_file
     ensure
       FFI::WIN32.CloseHandle(handle) if handle
     end

data/lib/puppet/util/windows/monkey_patches/process.rb

@@ -184,7 +184,7 @@ module Process
       raise TypeError unless int_priority.is_a?(Integer)
 
       int = Process.pid if int == 0
-      handle = OpenProcess(PROCESS_SET_INFORMATION, 0 , int)
+      handle = OpenProcess(PROCESS_SET_INFORMATION, 0, int)
 
       if handle == 0
         raise SystemCallError, FFI.errno, "OpenProcess"

data/lib/puppet/util/windows/principal.rb

@@ -66,21 +66,22 @@ module Puppet::Util::Windows::SID
                   last_error = FFI.errno
 
                   if (success == FFI::WIN32_FALSE && last_error != ERROR_INSUFFICIENT_BUFFER)
-                    raise Puppet::Util::Windows::Error.new(_('Failed to call LookupAccountNameW with account: %{account_name}') % { account_name: account_name}, last_error)
+                    raise Puppet::Util::Windows::Error.new(_('Failed to call LookupAccountNameW with account: %{account_name}') % { account_name: account_name }, last_error)
                   end
 
                   FFI::MemoryPointer.new(:lpwstr, domain_length_ptr.read_dword) do |domain_ptr|
                     if LookupAccountNameW(system_name_ptr, account_name_ptr,
                                           sid_ptr, sid_length_ptr,
                                           domain_ptr, domain_length_ptr, name_use_enum_ptr) == FFI::WIN32_FALSE
-                      raise Puppet::Util::Windows::Error.new(_('Failed to call LookupAccountNameW with account: %{account_name}') % { account_name: account_name} )
+                      raise Puppet::Util::Windows::Error.new(_('Failed to call LookupAccountNameW with account: %{account_name}') % { account_name: account_name })
                     end
 
                     # with a SID returned, loop back through lookup_account_sid to retrieve official name
                     # necessary when accounts like . or '' are passed in
                     return lookup_account_sid(
                       system_name,
-                      sid_ptr.read_bytes(sid_length_ptr.read_dword).unpack('C*'))
+                      sid_ptr.read_bytes(sid_length_ptr.read_dword).unpack('C*')
+                    )
                   end
                 end
               end
@@ -120,14 +121,14 @@ module Puppet::Util::Windows::SID
                 last_error = FFI.errno
 
                 if (success == FFI::WIN32_FALSE && last_error != ERROR_INSUFFICIENT_BUFFER)
-                  raise Puppet::Util::Windows::Error.new(_('Failed to call LookupAccountSidW with bytes: %{sid_bytes}') % { sid_bytes: sid_bytes}, last_error)
+                  raise Puppet::Util::Windows::Error.new(_('Failed to call LookupAccountSidW with bytes: %{sid_bytes}') % { sid_bytes: sid_bytes }, last_error)
                 end
 
                 FFI::MemoryPointer.new(:lpwstr, name_length_ptr.read_dword) do |name_ptr|
                   FFI::MemoryPointer.new(:lpwstr, domain_length_ptr.read_dword) do |domain_ptr|
                     if LookupAccountSidW(system_name_ptr, sid_ptr, name_ptr, name_length_ptr,
                                          domain_ptr, domain_length_ptr, name_use_enum_ptr) == FFI::WIN32_FALSE
-                      raise Puppet::Util::Windows::Error.new(_('Failed to call LookupAccountSidW with bytes: %{sid_bytes}') % { sid_bytes: sid_bytes} )
+                      raise Puppet::Util::Windows::Error.new(_('Failed to call LookupAccountSidW with bytes: %{sid_bytes}') % { sid_bytes: sid_bytes })
                     end
 
                     return new(
@@ -135,7 +136,8 @@ module Puppet::Util::Windows::SID
                       sid_bytes,
                       Puppet::Util::Windows::SID.sid_ptr_to_string(sid_ptr),
                       domain_ptr.read_wide_string(domain_length_ptr.read_dword),
-                      SID_NAME_USE[name_use_enum_ptr.read_uint32])
+                      SID_NAME_USE[name_use_enum_ptr.read_uint32]
+                    )
                   end
                 end
               end

data/lib/puppet/util/windows/process.rb

@@ -54,7 +54,7 @@ module Puppet::Util::Windows::Process
       # and since it's read-only, we can't set it. But we can execute a
       # a shell that simply returns the desired exit status, which has the
       # desired effect.
-      %x{#{ENV['COMSPEC']} /c exit #{exit_status}}
+      %x{#{ENV.fetch('COMSPEC', nil)} /c exit #{exit_status}}
     end
 
     exit_status
@@ -74,7 +74,8 @@ module Puppet::Util::Windows::Process
       phandle = OpenProcess(desired_access, inherit, process_id)
       if phandle == FFI::Pointer::NULL_HANDLE
         raise Puppet::Util::Windows::Error.new(
-          "OpenProcess(#{desired_access.to_s(8)}, #{inherit}, #{process_id})")
+          "OpenProcess(#{desired_access.to_s(8)}, #{inherit}, #{process_id})"
+        )
       end
 
       yield phandle
@@ -94,7 +95,8 @@ module Puppet::Util::Windows::Process
         result = OpenProcessToken(handle, desired_access, token_handle_ptr)
         if result == FFI::WIN32_FALSE
           raise Puppet::Util::Windows::Error.new(
-            "OpenProcessToken(#{handle}, #{desired_access.to_s(8)}, #{token_handle_ptr})")
+            "OpenProcessToken(#{handle}, #{desired_access.to_s(8)}, #{token_handle_ptr})"
+          )
         end
 
         yield token_handle = token_handle_ptr.read_handle
@@ -136,8 +138,9 @@ module Puppet::Util::Windows::Process
             result = QueryFullProcessImageNameW(phandle, use_win32_path_format, exe_name_ptr, exe_name_length_ptr)
             if result == FFI::WIN32_FALSE
               raise Puppet::Util::Windows::Error.new(
-                "QueryFullProcessImageNameW(phandle, #{use_win32_path_format}, " +
-                "exe_name_ptr, #{max_chars}")
+                "QueryFullProcessImageNameW(phandle, #{use_win32_path_format}, " \
+                "exe_name_ptr, #{max_chars}"
+              )
             end
             image_name = exe_name_ptr.read_wide_string(exe_name_length_ptr.read_dword)
           end
@@ -159,7 +162,8 @@ module Puppet::Util::Windows::Process
 
       if result == FFI::WIN32_FALSE
         raise Puppet::Util::Windows::Error.new(
-          "LookupPrivilegeValue(#{system_name}, #{name}, #{luid_ptr})")
+          "LookupPrivilegeValue(#{system_name}, #{name}, #{luid_ptr})"
+        )
       end
 
       yield LUID.new(luid_ptr)
@@ -178,7 +182,8 @@ module Puppet::Util::Windows::Process
 
       if return_length <= 0
         raise Puppet::Util::Windows::Error.new(
-          "GetTokenInformation(#{token_handle}, #{token_information}, nil, 0, #{return_length_ptr})")
+          "GetTokenInformation(#{token_handle}, #{token_information}, nil, 0, #{return_length_ptr})"
+        )
       end
 
       # re-call API with properly sized buffer for all results
@@ -188,8 +193,9 @@ module Puppet::Util::Windows::Process
 
         if result == FFI::WIN32_FALSE
           raise Puppet::Util::Windows::Error.new(
-            "GetTokenInformation(#{token_handle}, #{token_information}, #{token_information_buf}, " +
-              "#{return_length}, #{return_length_ptr})")
+            "GetTokenInformation(#{token_handle}, #{token_information}, #{token_information_buf}, " \
+            "#{return_length}, #{return_length_ptr})"
+          )
         end
 
         yield token_information_buf
@@ -310,19 +316,19 @@ module Puppet::Util::Windows::Process
 
     # pass :invalid => :replace to the Ruby String#encode to use replacement characters
     pairs = env_ptr.read_arbitrary_wide_string_up_to(65534, :double_null, { :invalid => :replace })
-      .split(?\x00)
-      .reject { |env_str| env_str.nil? || env_str.empty? || env_str[0] == '=' }
-      .reject do |env_str|
-        # reject any string containing the Unicode replacement character
-        if env_str.include?("\uFFFD")
-          Puppet.warning(_("Discarding environment variable %{string} which contains invalid bytes") % { string: env_str })
-          true
-        end
-      end
-      .map { |env_pair| env_pair.split('=', 2) }
-    Hash[ pairs ]
+                   .split(?\x00)
+                   .reject { |env_str| env_str.nil? || env_str.empty? || env_str[0] == '=' }
+                   .reject do |env_str|
+                     # reject any string containing the Unicode replacement character
+                     if env_str.include?("\uFFFD")
+                       Puppet.warning(_("Discarding environment variable %{string} which contains invalid bytes") % { string: env_str })
+                       true
+                     end
+                   end
+                   .map { |env_pair| env_pair.split('=', 2) }
+    pairs.to_h
   ensure
-    if env_ptr && ! env_ptr.null?
+    if env_ptr && !env_ptr.null?
       if FreeEnvironmentStringsW(env_ptr) == FFI::WIN32_FALSE
         Puppet.debug "FreeEnvironmentStringsW memory leak"
       end
@@ -331,7 +337,7 @@ module Puppet::Util::Windows::Process
   module_function :get_environment_strings
 
   def set_environment_variable(name, val)
-    raise Puppet::Util::Windows::Error(_('environment variable name must not be nil or empty')) if ! name || name.empty?
+    raise Puppet::Util::Windows::Error(_('environment variable name must not be nil or empty')) if !name || name.empty?
 
     FFI::MemoryPointer.from_string_to_wide_string(name) do |name_ptr|
       if (val.nil?)

data/lib/puppet/util/windows/registry.rb

@@ -17,6 +17,8 @@ module Puppet::Util::Windows
 
     ERROR_NO_MORE_ITEMS = 259
 
+    WCHAR_SIZE = FFI.type_size(:wchar)
+
     def root(name)
       Win32::Registry.const_get(name)
     rescue NameError
@@ -160,8 +162,7 @@ module Puppet::Util::Windows
           result = RegEnumValueW(key.hkey, index,
                                  subkey_ptr, subkey_length_ptr,
                                  FFI::Pointer::NULL, FFI::Pointer::NULL,
-                                 FFI::Pointer::NULL, FFI::Pointer::NULL
-          )
+                                 FFI::Pointer::NULL, FFI::Pointer::NULL)
 
           break if result == ERROR_NO_MORE_ITEMS
 
@@ -191,8 +192,7 @@ module Puppet::Util::Windows
                                     max_subkey_name_length_ptr, FFI::MemoryPointer::NULL,
                                     FFI::MemoryPointer::NULL, max_value_name_length_ptr,
                                     FFI::MemoryPointer::NULL, FFI::MemoryPointer::NULL,
-                                    FFI::MemoryPointer::NULL
-          )
+                                    FFI::MemoryPointer::NULL)
 
           if status != FFI::ERROR_SUCCESS
             msg = _("Failed to query registry %{key} for sizes") % { key: key.keyname }
@@ -236,22 +236,22 @@ module Puppet::Util::Windows
 
         string_length = 0
         # buffer is raw bytes, *not* chars - less a NULL terminator
-        string_length = (byte_length / FFI.type_size(:wchar)) - 1 if byte_length > 0
+        string_length = (byte_length / WCHAR_SIZE) - 1 if byte_length > 0
 
         begin
           result = case type
                    when Win32::Registry::REG_SZ, Win32::Registry::REG_EXPAND_SZ
-                     [ type, data_ptr.read_wide_string(string_length, Encoding::UTF_8, true) ]
+                     [type, data_ptr.read_wide_string(string_length, Encoding::UTF_8, true)]
                    when Win32::Registry::REG_MULTI_SZ
-                     [ type, data_ptr.read_wide_string(string_length).split(/\0/) ]
+                     [type, data_ptr.read_wide_string(string_length).split(/\0/)]
                    when Win32::Registry::REG_BINARY
-                     [ type, data_ptr.read_bytes(byte_length) ]
+                     [type, data_ptr.read_bytes(byte_length)]
                    when Win32::Registry::REG_DWORD
-                     [ type, data_ptr.read_dword ]
+                     [type, data_ptr.read_dword]
                    when Win32::Registry::REG_DWORD_BIG_ENDIAN
-                     [ type, data_ptr.order(:big).read_dword ]
+                     [type, data_ptr.order(:big).read_dword]
                    when Win32::Registry::REG_QWORD
-                     [ type, data_ptr.read_qword ]
+                     [type, data_ptr.read_qword]
                    else
                      raise TypeError, _("Type %{type} is not supported.") % { type: type }
                    end
@@ -273,14 +273,47 @@ module Puppet::Util::Windows
                                     FFI::Pointer::NULL, type_ptr,
                                     FFI::Pointer::NULL, length_ptr)
 
-          FFI::MemoryPointer.new(:byte, length_ptr.read_dword) do |buffer_ptr|
+          # The call to RegQueryValueExW below is potentially unsafe:
+          # https://learn.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regqueryvalueexw
+          #
+          #   "If the data has the REG_SZ, REG_MULTI_SZ or REG_EXPAND_SZ type,
+          #   the string may not have been stored with the proper terminating
+          #   null characters. Therefore, even if the function returns
+          #   ERROR_SUCCESS, the application should ensure that the string is
+          #   properly terminated before using it; otherwise, it may overwrite a
+          #   buffer. (Note that REG_MULTI_SZ strings should have two
+          #   terminating null characters.)"
+          #
+          # Since we don't know if the values will be properly null terminated,
+          # extend the buffer to guarantee we can append one or two wide null
+          # characters, without overwriting any data.
+          base_bytes_len = length_ptr.read_dword
+          pad_bytes_len = case type_ptr.read_dword
+                          when Win32::Registry::REG_SZ, Win32::Registry::REG_EXPAND_SZ
+                            WCHAR_SIZE
+                          when Win32::Registry::REG_MULTI_SZ
+                            WCHAR_SIZE * 2
+                          else
+                            0
+                          end
+
+          FFI::MemoryPointer.new(:byte, base_bytes_len + pad_bytes_len) do |buffer_ptr|
             result = RegQueryValueExW(key.hkey, name_ptr,
                                       FFI::Pointer::NULL, type_ptr,
                                       buffer_ptr, length_ptr)
 
-            if result != FFI::ERROR_SUCCESS
+            # Ensure buffer is null terminated with 1 or 2 wchar nulls, depending on the type
+            if result == FFI::ERROR_SUCCESS
+              case type_ptr.read_dword
+              when Win32::Registry::REG_SZ, Win32::Registry::REG_EXPAND_SZ
+                buffer_ptr.put_uint16(base_bytes_len, 0)
+              when Win32::Registry::REG_MULTI_SZ
+                buffer_ptr.put_uint16(base_bytes_len, 0)
+                buffer_ptr.put_uint16(base_bytes_len + WCHAR_SIZE, 0)
+              end
+            else
               # buffer is raw bytes, *not* chars - less a NULL terminator
-              name_length = (name_ptr.size / FFI.type_size(:wchar)) - 1 if name_ptr.size > 0
+              name_length = (name_ptr.size / WCHAR_SIZE) - 1 if name_ptr.size > 0
               msg = _("Failed to read registry value %{value} at %{key}") % { value: name_ptr.read_wide_string(name_length), key: key.keyname }
               raise Puppet::Util::Windows::Error.new(msg, result)
             end

data/lib/puppet/util/windows/root_certs.rb

@@ -19,7 +19,7 @@ class Puppet::Util::Windows::RootCerts
   # @yieldparam cert [OpenSSL::X509::Certificate] each root certificate
   # @api public
   def each
-    @roots.each {|cert| yield cert}
+    @roots.each { |cert| yield cert }
   end
 
   # Returns a new instance.

data/lib/puppet/util/windows/security.rb

@@ -214,25 +214,25 @@ module Puppet::Util::Windows::Security
 
       case ace.sid
       when sd.owner
-        MASK_TO_MODE.each_pair do |k,v|
+        MASK_TO_MODE.each_pair do |k, v|
           if (ace.mask & k) == k
             mode |= (v << 6)
           end
         end
       when sd.group
-        MASK_TO_MODE.each_pair do |k,v|
+        MASK_TO_MODE.each_pair do |k, v|
           if (ace.mask & k) == k
             mode |= (v << 3)
           end
         end
       when well_known_world_sid
-        MASK_TO_MODE.each_pair do |k,v|
+        MASK_TO_MODE.each_pair do |k, v|
           if (ace.mask & k) == k
             mode |= (v << 6) | (v << 3) | v
           end
         end
         if File.directory?(path) &&
-          (ace.mask & (FILE::FILE_WRITE_DATA | FILE::FILE_EXECUTE | FILE::FILE_DELETE_CHILD)) == (FILE::FILE_WRITE_DATA | FILE::FILE_EXECUTE)
+           (ace.mask & (FILE::FILE_WRITE_DATA | FILE::FILE_EXECUTE | FILE::FILE_DELETE_CHILD)) == (FILE::FILE_WRITE_DATA | FILE::FILE_EXECUTE)
           mode |= S_ISVTX;
         end
       when well_known_nobody_sid
@@ -287,20 +287,20 @@ module Puppet::Util::Windows::Security
     well_known_system_sid = Puppet::Util::Windows::SID::LocalSystem
 
     owner_allow = FILE::STANDARD_RIGHTS_ALL  |
-      FILE::FILE_READ_ATTRIBUTES |
-      FILE::FILE_WRITE_ATTRIBUTES
+                  FILE::FILE_READ_ATTRIBUTES |
+                  FILE::FILE_WRITE_ATTRIBUTES
     # this prevents a mode that is not 7 from taking ownership of a file based
     # on group membership and rewriting it / making it executable
     group_allow = FILE::STANDARD_RIGHTS_READ |
-      FILE::FILE_READ_ATTRIBUTES |
-      FILE::SYNCHRONIZE
+                  FILE::FILE_READ_ATTRIBUTES |
+                  FILE::SYNCHRONIZE
     other_allow = FILE::STANDARD_RIGHTS_READ |
-      FILE::FILE_READ_ATTRIBUTES |
-      FILE::SYNCHRONIZE
+                  FILE::FILE_READ_ATTRIBUTES |
+                  FILE::SYNCHRONIZE
     nobody_allow = 0
     system_allow = 0
 
-    MODE_TO_MASK.each do |k,v|
+    MODE_TO_MASK.each do |k, v|
       if ((mode >> 6) & k) == k
         owner_allow |= v
       end
@@ -328,7 +328,7 @@ module Puppet::Util::Windows::Security
     isownergroup = sd.owner == sd.group
 
     # caller is NOT managing SYSTEM by using group or owner, so set to FULL
-    if ! [sd.owner, sd.group].include? well_known_system_sid
+    if ![sd.owner, sd.group].include? well_known_system_sid
       # we don't check S_ISYSTEM_MISSING bit, but automatically carry over existing SYSTEM perms
       # by default set SYSTEM perms to full
       system_allow = FILE::FILE_ALL_ACCESS
@@ -387,7 +387,7 @@ module Puppet::Util::Windows::Security
 
     # if any ACE allows write, then clear readonly bit, but do this before we overwrite
     # the DACl and lose our ability to set the attribute
-    if ((owner_allow | group_allow | other_allow ) & FILE::FILE_WRITE_DATA) == FILE::FILE_WRITE_DATA
+    if ((owner_allow | group_allow | other_allow) & FILE::FILE_WRITE_DATA) == FILE::FILE_WRITE_DATA
       FILE.remove_attributes(path, FILE::FILE_ATTRIBUTE_READONLY)
     end
 
@@ -403,7 +403,7 @@ module Puppet::Util::Windows::Security
     # TODO: system should be first?
     flags = !isdir ? 0 :
       Puppet::Util::Windows::AccessControlEntry::CONTAINER_INHERIT_ACE |
-      Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE
+        Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE
     dacl.allow(well_known_system_sid, system_allow, flags)
 
     # add inherit-only aces for child dirs and files that are created within the dir
@@ -486,7 +486,7 @@ module Puppet::Util::Windows::Security
 
         ace_type = ace[:Header][:AceType]
         if ace_type != Puppet::Util::Windows::AccessControlEntry::ACCESS_ALLOWED_ACE_TYPE &&
-          ace_type != Puppet::Util::Windows::AccessControlEntry::ACCESS_DENIED_ACE_TYPE
+           ace_type != Puppet::Util::Windows::AccessControlEntry::ACCESS_DENIED_ACE_TYPE
           Puppet.warning _("Unsupported access control entry type: 0x%{type}") % { type: ace_type.to_s(16) }
           next
         end
@@ -518,7 +518,8 @@ module Puppet::Util::Windows::Security
       FFI::Pointer::NULL, # security_attributes
       FILE::OPEN_EXISTING,
       FILE::FILE_FLAG_OPEN_REPARSE_POINT | FILE::FILE_FLAG_BACKUP_SEMANTICS,
-      FFI::Pointer::NULL_HANDLE) # template
+      FFI::Pointer::NULL_HANDLE
+    ) # template
 
     if handle == Puppet::Util::Windows::File::INVALID_HANDLE_VALUE
       raise Puppet::Util::Windows::Error.new(_("Failed to open '%{path}'") % { path: path })
@@ -596,7 +597,8 @@ module Puppet::Util::Windows::Security
                   group_sid_ptr_ptr,
                   dacl_ptr_ptr,
                   FFI::Pointer::NULL, # sacl
-                  sd_ptr_ptr) # sec desc
+                  sd_ptr_ptr
+                ) # sec desc
                 raise Puppet::Util::Windows::Error.new(_("Failed to get security information")) if rv != FFI::ERROR_SUCCESS
 
                 # these 2 convenience params are not freed since they point inside sd_ptr
@@ -802,7 +804,7 @@ module Puppet::Util::Windows::Security
   # https://stackoverflow.com/a/1792930
   MAXIMUM_SID_BYTES_LENGTH = 68
   MAXIMUM_GENERIC_ACE_SIZE = GENERIC_ACCESS_ACE.offset_of(:SidStart) +
-    MAXIMUM_SID_BYTES_LENGTH
+                             MAXIMUM_SID_BYTES_LENGTH
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa446634(v=vs.85).aspx
   # BOOL WINAPI GetAce(

data/lib/puppet/util/windows/service.rb

@@ -111,7 +111,7 @@ module Puppet::Util::Windows
         end
       end
       if state.nil?
-        raise Puppet::Error.new(_("Unknown Service state '%{current_state}' for '%{service_name}'") % { current_state: state.to_s, service_name: service_name})
+        raise Puppet::Error.new(_("Unknown Service state '%{current_state}' for '%{service_name}'") % { current_state: state.to_s, service_name: service_name })
       end
 
       state
@@ -139,7 +139,7 @@ module Puppet::Util::Windows
         end
       end
       if start_type.nil?
-        raise Puppet::Error.new(_("Unknown start type '%{start_type}' for '%{service_name}'") % { start_type: start_type.to_s, service_name: service_name})
+        raise Puppet::Error.new(_("Unknown start type '%{start_type}' for '%{service_name}'") % { start_type: start_type.to_s, service_name: service_name })
       end
 
       start_type
@@ -520,7 +520,7 @@ module Puppet::Util::Windows
               bytes_pointer
             )
             if success == FFI::WIN32_FALSE
-              raise Puppet::Util::Windows::Error.new(_("Service query for %{parameter_name} failed") % { parameter_name: SERVICE_CONFIG_TYPES[info_level] } )
+              raise Puppet::Util::Windows::Error.new(_("Service query for %{parameter_name} failed") % { parameter_name: SERVICE_CONFIG_TYPES[info_level] })
             end
 
             yield config
@@ -544,7 +544,7 @@ module Puppet::Util::Windows
             value,  # lpInfo
           )
           if success == FFI::WIN32_FALSE
-            raise Puppet::Util::windows::Error.new(_("Failed to update service %{change} configuration") % { change: change } )
+            raise Puppet::Util.windows::Error.new(_("Failed to update service %{change} configuration") % { change: change })
           end
         end
       end

data/lib/puppet/util/windows/sid.rb

@@ -115,7 +115,7 @@ module Puppet::Util::Windows
     # removed from the domain
     def ads_to_principal(ads_object)
       if !ads_object || !ads_object.respond_to?(:ole_respond_to?) ||
-        !ads_object.ole_respond_to?(:objectSID) || !ads_object.ole_respond_to?(:Name)
+         !ads_object.ole_respond_to?(:objectSID) || !ads_object.ole_respond_to?(:Name)
         raise Puppet::Error.new("ads_object must be an IAdsUser or IAdsGroup instance")
       end
 
@@ -126,8 +126,8 @@ module Puppet::Util::Windows
 
       # if the Name property isn't formatted like a SID, OR
       if !valid_sid?(ads_object.Name) ||
-        # if the objectSID doesn't match the Name property, also raise
-        ((converted = octet_string_to_sid_string(ads_object.objectSID)) != ads_object.Name)
+         # if the objectSID doesn't match the Name property, also raise
+         ((converted = octet_string_to_sid_string(ads_object.objectSID)) != ads_object.Name)
         raise Puppet::Error.new("ads_object Name: #{ads_object.Name} invalid or does not match objectSID: #{ads_object.objectSID} (#{converted})", e)
       end
 
@@ -159,7 +159,7 @@ module Puppet::Util::Windows
 
     # Convert a SID pointer to a SID string, e.g. "S-1-5-32-544".
     def sid_ptr_to_string(psid)
-      if ! psid.kind_of?(FFI::Pointer) || IsValidSid(psid) == FFI::WIN32_FALSE
+      if !psid.is_a?(FFI::Pointer) || IsValidSid(psid) == FFI::WIN32_FALSE
         raise Puppet::Util::Windows::Error.new(_("Invalid SID"))
       end
 
@@ -209,7 +209,7 @@ module Puppet::Util::Windows
       valid = false
 
       begin
-        string_to_sid_ptr(string_sid) { |ptr| valid = ! ptr.nil? && ! ptr.null? }
+        string_to_sid_ptr(string_sid) { |ptr| valid = !ptr.nil? && !ptr.null? }
       rescue Puppet::Util::Windows::Error => e
         raise if e.code != ERROR_INVALID_SID_STRUCTURE
       end
@@ -220,7 +220,7 @@ module Puppet::Util::Windows
 
     def get_length_sid(sid_ptr)
       # MSDN states IsValidSid should be called on pointer first
-      if ! sid_ptr.kind_of?(FFI::Pointer) || IsValidSid(sid_ptr) == FFI::WIN32_FALSE
+      if !sid_ptr.is_a?(FFI::Pointer) || IsValidSid(sid_ptr) == FFI::WIN32_FALSE
         raise Puppet::Util::Windows::Error.new(_("Invalid SID"))
       end
 
@@ -249,7 +249,8 @@ module Puppet::Util::Windows
         nil, # domain
         # https://msdn.microsoft.com/en-us/library/cc245534.aspx?f=255&MSPPError=-2147217396
         # Indicates that the type of object could not be determined. For example, no object with that SID exists.
-        :SidTypeUnknown)
+        :SidTypeUnknown
+      )
     end
 
     ffi_convention :stdcall

data/lib/puppet/util/windows/user.rb

@@ -21,7 +21,7 @@ module Puppet::Util::Windows::User
   # This account is not recognized by the security subsystem, so you cannot specify its name in a call to the `LookupAccountName` function.
   # https://docs.microsoft.com/en-us/windows/win32/services/localsystem-account
   def localsystem?(name)
-    ["LocalSystem", ".\\LocalSystem", "#{Puppet::Util::Windows::ADSI.computer_name}\\LocalSystem"].any?{ |s| s.casecmp(name) == 0 }
+    ["LocalSystem", ".\\LocalSystem", "#{Puppet::Util::Windows::ADSI.computer_name}\\LocalSystem"].any? { |s| s.casecmp(name) == 0 }
   end
   module_function :localsystem?
 
@@ -101,7 +101,7 @@ module Puppet::Util::Windows::User
         # try logon using network else try logon using interactive mode
         if logon_user_by_logon_type(name, domain, password, fLOGON32_LOGON_NETWORK, fLOGON32_PROVIDER_DEFAULT, token_pointer) == FFI::WIN32_FALSE
           if logon_user_by_logon_type(name, domain, password, fLOGON32_LOGON_INTERACTIVE, fLOGON32_PROVIDER_DEFAULT, token_pointer) == FFI::WIN32_FALSE
-            raise Puppet::Util::Windows::Error.new(_("Failed to logon user %{name}") % {name: name.inspect})
+            raise Puppet::Util::Windows::Error.new(_("Failed to logon user %{name}") % { name: name.inspect })
           end
         end
 
@@ -332,6 +332,7 @@ module Puppet::Util::Windows::User
                           [:handle, :pointer, :pbool], :win32_bool
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379650(v=vs.85).aspx
+  # rubocop:disable Layout/SpaceBeforeComma
   WELL_KNOWN_SID_TYPE = enum(
     :WinNullSid                                   , 0,
     :WinWorldSid                                  , 1,
@@ -429,6 +430,7 @@ module Puppet::Util::Windows::User
     :WinCapabilityEnterpriseAuthenticationSid     , 93,
     :WinCapabilityRemovableStorageSid             , 94
   )
+  # rubocop:enable Layout/SpaceBeforeComma
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa446585(v=vs.85).aspx
   # BOOL WINAPI CreateWellKnownSid(