From 2ce669c7f8aea6b66b2150798a5ef4d253b00a2e Mon Sep 17 00:00:00 2001
From: Jeff McCune <jeff@puppetlabs.com>
Date: Wed, 7 Mar 2012 11:52:30 -0800
Subject: (#12357) Add validate_absolute_path() function

This patch adds a new function to validate if a string is an absolute
filesystem path or not.

The intent of this is to make this functionality generic and reusable.
Josh left a comment in another pull request I had:

    If node_installdir or $node_vardir is not defined, then we should
    raise an error, otherwise we may create a scheduled task to an
    untrusted directory.

One solution to this comment is to validate the Puppet variable is an
absolute path.

Examples of this function look like:

    function_validate_absolute_path
      Using Puppet::Parser::Scope.new
        Garbage inputs
          validate_absolute_path(nil) should fail
          validate_absolute_path([nil]) should fail
          validate_absolute_path({"foo"=>"bar"}) should fail
          validate_absolute_path({}) should fail
          validate_absolute_path("") should fail
        relative paths
          validate_absolute_path("relative1") should fail
          validate_absolute_path(".") should fail
          validate_absolute_path("..") should fail
          validate_absolute_path("./foo") should fail
          validate_absolute_path("../foo") should fail
          validate_absolute_path("etc/puppetlabs/puppet") should fail
          validate_absolute_path("opt/puppet/bin") should fail
        absolute paths
          validate_absolute_path("C:/") should not fail
          validate_absolute_path("C:\\") should not fail
          validate_absolute_path("C:\\WINDOWS\\System32") should not fail
          validate_absolute_path("C:/windows/system32") should not fail
          validate_absolute_path("X:/foo/bar") should not fail
          validate_absolute_path("X:\\foo\\bar") should not fail
          validate_absolute_path("/var/tmp") should not fail
          validate_absolute_path("/var/lib/puppet") should not fail
          validate_absolute_path("/var/opt/../lib/puppet") should not fail
          validate_absolute_path("C:\\Program Files (x86)\\Puppet Labs\\Puppet Enterprise") should not fail
          validate_absolute_path("C:/Program Files (x86)/Puppet Labs/Puppet Enterprise") should not fail

    Finished in 0.05637 seconds
    23 examples, 0 failures
---
 .../parser/functions/validate_absolute_path.rb     | 38 ++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 lib/puppet/parser/functions/validate_absolute_path.rb

(limited to 'lib/puppet/parser/functions')

diff --git a/lib/puppet/parser/functions/validate_absolute_path.rb b/lib/puppet/parser/functions/validate_absolute_path.rb
new file mode 100644
index 0000000..46f86ec
--- /dev/null
+++ b/lib/puppet/parser/functions/validate_absolute_path.rb
@@ -0,0 +1,38 @@
+module Puppet::Parser::Functions
+  newfunction(:validate_absolute_path, :doc => <<-'ENDHEREDOC') do |args|
+    Validate the string represents an absolute path in the filesystem.  This function works
+    for windows and unix style paths.
+
+    The following values will pass:
+
+        $my_path = "C:/Program Files (x86)/Puppet Labs/Puppet"
+        validate_absolute_path($my_path)
+        $my_path2 = "/var/lib/puppet"
+        validate_absolute_path($my_path2)
+
+
+    The following values will fail, causing compilation to abort:
+
+        validate_absolute_path(true)
+        validate_absolute_path([ 'var/lib/puppet', '/var/foo' ])
+        validate_absolute_path([ '/var/lib/puppet', 'var/foo' ])
+        $undefined = undef
+        validate_absolute_path($undefined)
+
+    ENDHEREDOC
+
+    require 'puppet/util'
+
+    unless args.length > 0 then
+      raise Puppet::ParseError, ("validate_absolute_path(): wrong number of arguments (#{args.length}; must be > 0)")
+    end
+
+    args.each do |arg|
+      # This logic was borrowed from
+      # [lib/puppet/file_serving/base.rb](https://github.com/puppetlabs/puppet/blob/master/lib/puppet/file_serving/base.rb)
+      unless Puppet::Util.absolute_path?(arg, :posix) or Puppet::Util.absolute_path?(arg, :windows)
+        raise Puppet::ParseError, ("#{arg.inspect} is not an absolute path.")
+      end
+    end
+  end
+end
-- 
cgit v1.2.3