train-core 3.14.1 → 3.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 66333c4f0d4ee9976b1a803fa36db769f2763586a2d04628a091a125572e1345
-  data.tar.gz: fcabe9e05c7112a958eb4d80ea9f578434eaba6ea116bab402f0c5d46c95c2f0
+  metadata.gz: 1d838f638d6bbc471fdd186099014d342ec80ea3d208885d709351ed1564d96d
+  data.tar.gz: 4a3c73b0faed531af7e55578a94e76754a6ce408a1a6aac706bc2a05eff7b5f1
 SHA512:
-  metadata.gz: 7335b3594bc9649282d1ca2e3c2ee0e6ee5094053c7130a554f6e2fed36dfd65440d9eaa727b60a6bf78a8cbf0afe65bf1275589614826fee73c6d7fb15c8406
-  data.tar.gz: 5ebe748390217d2f1d144af77050d1d6d86ffaca03055dabbd0254e40d8a3282d239636e546fabcd3e02d5798628038e1400a3da1e6398fd81188be41956bdf5
+  metadata.gz: 5e379c906184e37a441b6c9736b95b6fd6fa724bccba8f626b964b4342305f201b4fce792bb81e4c275b8b49036aa2cad97c0682880529029354530e6d06d121
+  data.tar.gz: 72a4cfe2de2a43d359fb63c23f48264b8b316b5513693150ac256d10a867514722b5445619571b845256aeac157feaf06ea54f36288e5f192421cf6a4cf4b487

data/lib/train/transports/local.rb

@@ -230,6 +230,12 @@ module Train::Transports
 
           pipe = nil
 
+          # Verify ownership before connecting
+          owner, current_user, is_owner = pipe_owned_by_current_user?(pipe_name)
+          unless is_owner
+            raise PipeError, "Unauthorized user '#{current_user}' tried to connect to pipe '#{pipe_name}'. Pipe is owned by '#{owner}'."
+          end
+
           # PowerShell needs time to create pipe.
           100.times do
             pipe = open("//./pipe/#{pipe_name}", "r+")
@@ -246,8 +252,11 @@ module Train::Transports
 
           script = <<-EOF
             $ErrorActionPreference = 'Stop'
-
-            $pipeServer = New-Object System.IO.Pipes.NamedPipeServerStream('#{pipe_name}')
+            $user = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
+            $pipeSecurity = New-Object System.IO.Pipes.PipeSecurity
+            $rule = New-Object System.IO.Pipes.PipeAccessRule($user, "FullControl", "Allow")
+            $pipeSecurity.AddAccessRule($rule)
+            $pipeServer = New-Object System.IO.Pipes.NamedPipeServerStream('#{pipe_name}', [System.IO.Pipes.PipeDirection]::InOut, 1, [System.IO.Pipes.PipeTransmissionMode]::Byte, [System.IO.Pipes.PipeOptions]::None, 4096, 4096, $pipeSecurity)
             $pipeReader = New-Object System.IO.StreamReader($pipeServer)
             $pipeWriter = New-Object System.IO.StreamWriter($pipeServer)
 
@@ -288,6 +297,29 @@ module Train::Transports
           cmd = "#{@powershell_cmd} -NoProfile -ExecutionPolicy bypass -NonInteractive -EncodedCommand #{base64_script}"
           Process.create(command_line: cmd).process_id
         end
+
+        def current_windows_user
+          user = `powershell -Command "[System.Security.Principal.WindowsIdentity]::GetCurrent().Name"`.strip
+          if user.nil? || user.empty?
+            user = `whoami`.strip
+          end
+          if user.nil? || user.empty?
+            raise "Unable to determine current Windows user"
+          end
+
+          user
+        end
+
+        # Verify pipe ownership before connecting
+        def pipe_owned_by_current_user?(pipe_name)
+          exists = `powershell -Command "Test-Path \\\\.\\pipe\\#{pipe_name}"`.strip.downcase == "true"
+          current_user = current_windows_user
+          return [nil, current_user, false] unless exists
+
+          owner = `powershell -Command "(Get-Acl \\\\.\\pipe\\#{pipe_name}).Owner" 2>&1`.strip
+          is_owner = !owner.nil? && !current_user.nil? && owner.casecmp(current_user) == 0
+          [owner, current_user, is_owner]
+        end
       end
     end
   end

data/lib/train/version.rb

@@ -2,5 +2,5 @@
 # Author:: Dominik Richter (<dominik.richter@gmail.com>)
 
 module Train
-  VERSION = "3.14.1".freeze
+  VERSION = "3.15.0".freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: train-core
 version: !ruby/object:Gem::Version
-  version: 3.14.1
+  version: 3.15.0
 platform: ruby
 authors:
 - Chef InSpec Team
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2025-12-15 00:00:00.000000000 Z
+date: 2025-12-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable