train-core 3.15.2 → 3.16.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 93eb56f75bd0bb4445766f711e0c6a4bc9c9b4b7dcdbce27065cdbe1d77f173a
-  data.tar.gz: 48da5db98b20cc50e46a76f7c293fc3d7c659073081a3ac5d3e5b1e0bad6aa8b
+  metadata.gz: f539d85c4bc8d03bd8892d11fdd131db8e8ba62a4d478ba89c056e122167a8ba
+  data.tar.gz: 41171d85c20e5420efefec62dd5a312ea9768921283d9c34431b6fd604762401
 SHA512:
-  metadata.gz: 15d5e62ef1c5e23f91a49f23a358f27d1b7e3297614419d5b15dedc9b25ec9848881b1c955693d75c2b5eece7783829c376210dc52d69ba92754cb1ba134f07a
-  data.tar.gz: da106c56945fa66b0bf01917276bf9bc5b694787c7e4b1a1cfdb8ff6c9e73a6f737c0a98e7df0f5d1f656c936e9dc388ec19db967733ecd197cb47e0fa012c83
+  metadata.gz: 9e1ec8264a1b3ed12ec9e667d28cdeeea4ddf90b658b727f69233a93ce34abe16444509d9e85037fb418bc404d423ad636fa8eba94e49be2ffc9982300bd704f
+  data.tar.gz: c513db316ea377f56fb1096713743191e5817e85797ff2307ec9bcbfa904e30c8a8cedb6e516a0dae14ac660dcc418d6f80ba8fae291dfab4b55d849e0dddead

data/lib/train/transports/local.rb

@@ -229,11 +229,28 @@ module Train::Transports
           at_exit { close rescue Errno::EIO }
 
           pipe = nil
+          ownership_verified = false
 
           # PowerShell needs time to create pipe.
           100.times do
+            unless ownership_verified
+              owner, current_user, is_owner = pipe_owned_by_current_user?(pipe_name)
+              if owner.nil?
+                sleep 0.1
+                next
+              end
+
+              unless is_owner
+                raise PipeError, "Unauthorized user '#{current_user}' tried to connect to pipe '#{pipe_name}'. Pipe is owned by '#{owner}'."
+              end
+
+              ownership_verified = true
+            end
+
             pipe = open("//./pipe/#{pipe_name}", "r+")
             break
+          rescue PipeError
+            raise
           rescue
             sleep 0.1
           end
@@ -246,17 +263,26 @@ module Train::Transports
 
           script = <<-EOF
             $ErrorActionPreference = 'Stop'
+            $ProgressPreference = 'SilentlyContinue'
+            $user = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
+            $pipeSecurity = New-Object System.IO.Pipes.PipeSecurity
+            $rule = New-Object System.IO.Pipes.PipeAccessRule($user, "FullControl", "Allow")
+            $pipeSecurity.AddAccessRule($rule)
+            $pipeServer = New-Object System.IO.Pipes.NamedPipeServerStream('#{pipe_name}', [System.IO.Pipes.PipeDirection]::InOut, 1, [System.IO.Pipes.PipeTransmissionMode]::Byte, [System.IO.Pipes.PipeOptions]::None, 4096, 4096, $pipeSecurity)
+
+            $pipeServer.WaitForConnection()
 
-            $pipeServer = New-Object System.IO.Pipes.NamedPipeServerStream('#{pipe_name}')
             $pipeReader = New-Object System.IO.StreamReader($pipeServer)
             $pipeWriter = New-Object System.IO.StreamWriter($pipeServer)
 
-            $pipeServer.WaitForConnection()
-
             # Create loop to receive and process user commands/scripts
             $clientConnected = $true
             while($clientConnected) {
               $input = $pipeReader.ReadLine()
+              if ($input -eq $null) {
+                $clientConnected = $false
+                break
+              }
               $command = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($input))
 
               # Execute user command/script and convert result to JSON
@@ -278,8 +304,14 @@ module Train::Transports
 
               # Encode JSON in Base64 and write to pipe
               $encodedResult = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($resultJSON))
-              $pipeWriter.WriteLine($encodedResult)
-              $pipeWriter.Flush()
+              try {
+                $pipeWriter.WriteLine($encodedResult)
+                $pipeWriter.Flush()
+              } catch [System.IO.IOException] {
+                # Pipe was closed by client, exit gracefully
+                $clientConnected = $false
+                break
+              }
             }
           EOF
 
@@ -288,6 +320,29 @@ module Train::Transports
           cmd = "#{@powershell_cmd} -NoProfile -ExecutionPolicy bypass -NonInteractive -EncodedCommand #{base64_script}"
           Process.create(command_line: cmd).process_id
         end
+
+        def current_windows_user
+          user = `powershell -Command "[System.Security.Principal.WindowsIdentity]::GetCurrent().Name"`.strip
+          if user.nil? || user.empty?
+            user = `whoami`.strip
+          end
+          if user.nil? || user.empty?
+            raise "Unable to determine current Windows user"
+          end
+
+          user
+        end
+
+        # Verify pipe ownership before connecting
+        def pipe_owned_by_current_user?(pipe_name)
+          exists = `powershell -Command "Test-Path \\\\.\\pipe\\#{pipe_name}"`.strip.downcase == "true"
+          current_user = current_windows_user
+          return [nil, current_user, false] unless exists
+
+          owner = `powershell -Command "(Get-Acl \\\\.\\pipe\\#{pipe_name}).Owner" 2>&1`.strip
+          is_owner = !owner.nil? && !current_user.nil? && owner.casecmp(current_user) == 0
+          [owner, current_user, is_owner]
+        end
       end
     end
   end

data/lib/train/version.rb

@@ -2,5 +2,5 @@
 # Author:: Dominik Richter (<dominik.richter@gmail.com>)
 
 module Train
-  VERSION = "3.15.2".freeze
+  VERSION = "3.16.0".freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: train-core
 version: !ruby/object:Gem::Version
-  version: 3.15.2
+  version: 3.16.0
 platform: ruby
 authors:
 - Chef InSpec Team
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-01-09 00:00:00.000000000 Z
+date: 2026-01-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable