Fixing the security scanning warnings

.github/workflows/lint.yml

@@ -8,6 +8,9 @@ on:
       - main
       - 18-stable
 
+permissions:
+  contents: read
+
 concurrency:
   group: lint-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/sonarqube.yml

@@ -9,6 +9,9 @@ on:
       - 'release/**'
   pull_request:
       types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
 
 jobs:
   sonarqube:

lib/ohai/application.rb

@@ -49,7 +49,7 @@ class Ohai::Application
     short: "-l LEVEL",
     long: "--log_level LEVEL",
     description: "Set the log level (debug, info, warn, error, fatal)",
-    proc: lambda { |l| l.to_sym }
+    proc: lambda(&:to_sym)
 
   option :log_location,
     short: "-L LOGLOCATION",

lib/ohai/dsl/plugin/versionvii.rb

@@ -149,11 +149,11 @@ def optional?
         end
 
         def provides(*paths)
-          logger.warn("[UNSUPPORTED OPERATION] \'provides\' is no longer supported in a \'collect_data\' context. Please specify \'provides\' before collecting plugin data. Ignoring command \'provides #{paths.join(", ")}")
+          logger.warn("[UNSUPPORTED OPERATION] 'provides' is no longer supported in a 'collect_data' context. Please specify 'provides' before collecting plugin data. Ignoring command 'provides #{paths.join(", ")}")
         end
 
         def require_plugin(*args)
-          logger.warn("[UNSUPPORTED OPERATION] \'require_plugin\' is no longer supported. Please use \'depends\' instead.\nIgnoring plugin(s) #{args.join(", ")}")
+          logger.warn("[UNSUPPORTED OPERATION] 'require_plugin' is no longer supported. Please use 'depends' instead.\nIgnoring plugin(s) #{args.join(", ")}")
         end
 
         def configuration(option, *options)

lib/ohai/loader.rb

@@ -100,7 +100,7 @@ def load_plugin_class(plugin_path)
       contents = ""
       begin
         logger.trace("Loading plugin at #{plugin_path}")
-        contents << IO.read(plugin_path)
+        contents << File.read(plugin_path)
       rescue IOError, Errno::ENOENT
         logger.warn("Unable to open or read plugin at #{plugin_path}")
         return nil
@@ -110,9 +110,9 @@ def load_plugin_class(plugin_path)
       if contents.include?("Ohai.plugin")
         load_v7_plugin_class(contents, plugin_path)
       else
-        raise Exceptions::IllegalPluginDefinition, "[DEPRECATION] Plugin at #{plugin_path}"\
-        " is a version 6 plugin. Version 6 plugins are no longer supported by Ohai. This"\
-        " plugin will need to be updated to the v7 Ohai plugin format. See"\
+        raise Exceptions::IllegalPluginDefinition, "[DEPRECATION] Plugin at #{plugin_path}" \
+        " is a version 6 plugin. Version 6 plugins are no longer supported by Ohai. This" \
+        " plugin will need to be updated to the v7 Ohai plugin format. See" \
         " https://docs.chef.io/ohai_custom.html for v7 syntax."
       end
     end
@@ -151,7 +151,7 @@ def load_v7_plugin_class(contents, plugin_path)
     rescue Ohai::Exceptions::IllegalPluginDefinition => e
       logger.warn("Plugin Definition Error: <#{plugin_path}>: #{e.message}")
     rescue NoMethodError => e
-      logger.warn("Plugin Method Error: <#{plugin_path}>: unsupported operation \'#{e.name}\'")
+      logger.warn("Plugin Method Error: <#{plugin_path}>: unsupported operation '#{e.name}'")
     rescue SyntaxError => e
       # split on occurrences of
       #    <env>: syntax error,

lib/ohai/mixin/ec2_metadata.rb

@@ -248,8 +248,14 @@ def fetch_dynamic_data
       private
 
       def expand_path(file_name)
-        path = file_name.gsub(/\=.*$/, "/")
-        # ignore "./" and "../"
+        # First substitution - exactly matches original behavior but safer
+        path = if file_name.include?("=")
+                 file_name[0...file_name.index("=")] + "/"
+               else
+                 file_name.dup
+               end
+
+        # Handle relative path components
         path.gsub(%r{/\.\.?(?:/|$)}, "/")
           .sub(%r{^\.\.?(?:/|$)}, "")
           .sub(/^$/, "/")

lib/ohai/mixin/string.rb

@@ -25,7 +25,7 @@ class String
   # ActiveSupport::CoreExtensions::String::Inflections
   # @return [String]
   def wmi_underscore
-    gsub(/::/, "/").gsub(/([A-Z]+)([A-Z][a-z])/, '\1_\2')
+    gsub("::", "/").gsub(/([A-Z]+)([A-Z][a-z])/, '\1_\2')
       .gsub(/([a-z\d])([A-Z])/, '\1_\2').tr("-", "_").downcase
   end
 end

lib/ohai/plugins/aix/kernel.rb

@@ -26,11 +26,11 @@
 
     uname_so = shell_out("uname -rvp").stdout.split
 
-    kernel[:name] =    "aix" # this is here for historical reasons, but it's always aix
+    kernel[:name] = "aix" # this is here for historical reasons, but it's always aix
     kernel[:release] = uname_so[0]
     kernel[:version] = uname_so[1]
     kernel[:machine] = uname_so[2]
-    kernel[:bits] =    shell_out("getconf KERNEL_BITMODE").stdout.strip
+    kernel[:bits] = shell_out("getconf KERNEL_BITMODE").stdout.strip
 
     modules = Mash.new
     so = shell_out("genkex -d")

lib/ohai/plugins/aix/network.rb

@@ -120,7 +120,7 @@
           interface = $6
           ifaces[interface][:routes] ||= []
           ifaces[interface][:routes] << Mash.new( destination: $1, family: family,
-                                                  via: $2, flags: $3)
+            via: $2, flags: $3)
         end
       end
     end

lib/ohai/plugins/aix/virtualization.rb

@@ -143,7 +143,7 @@
           evalstr = "wpars['#{wpar_name}']"
           breadcrumb = attribute.split(".")
           breadcrumb.each do |node|
-            evalstr << "[\'#{node}\']"
+            evalstr << "['#{node}']"
           end
           wpars[wpar_name][breadcrumb[-1]] = eval evalstr # rubocop: disable Security/Eval
         end

lib/ohai/plugins/alibaba.rb

@@ -54,7 +54,7 @@ def file_val_if_exists(path)
   # a single check that combines all the various detection methods for Alibaba
   # @return [Boolean] Does the system appear to be on Alibaba
   def looks_like_alibaba?
-    return true if hint?("alibaba") || has_ali_dmi?
+    hint?("alibaba") || has_ali_dmi?
   end
 
   collect_data do

lib/ohai/plugins/cpu.rb

@@ -637,6 +637,6 @@ def valid_lscpu?(lscpu)
 
     cpu[:total] = logical_processors
     cpu[:cores] = cores
-    cpu[:real] =  processors.length
+    cpu[:real] = processors.length
   end
 end

lib/ohai/plugins/darwin/virtualization.rb

@@ -36,7 +36,7 @@ def ioreg_exists?
   end
 
   def fusion_exists?
-    file_exist?("/Applications/VMware\ Fusion.app/")
+    file_exist?("/Applications/VMware Fusion.app/")
   end
 
   def docker_exists?

lib/ohai/plugins/gce.rb

@@ -72,7 +72,7 @@ def looks_like_gce?
     return true if hint?("gce")
 
     if has_gce_dmi? || has_gce_system_info?
-      return true if can_socket_connect?(Ohai::Mixin::GCEMetadata::GCE_METADATA_ADDR, 80)
+      can_socket_connect?(Ohai::Mixin::GCEMetadata::GCE_METADATA_ADDR, 80)
     end
   end
 

lib/ohai/plugins/linux/interrupts.rb

@@ -27,9 +27,8 @@
   # each bit is a CPU, right to left ordering (i.e. CPU0 is rightmost)
   def parse_smp_affinity(path, cpus)
     masks = file_read(path).strip
-    bit_masks = []
-    masks.split(",").each do |mask|
-      bit_masks << mask.rjust(8, "0").to_i(16).to_s(2)
+    bit_masks = masks.split(",").map do |mask|
+      mask.rjust(8, "0").to_i(16).to_s(2)
     end
     affinity_mask = bit_masks.join
     affinity_by_cpu = affinity_mask.split("").reverse

lib/ohai/plugins/linux/network.rb

@@ -104,7 +104,7 @@ def check_routing_table(family, iface, default_route_table)
       end
       route_endings.each do |route_ending|
         route_entry = Mash.new(destination: route_dest,
-                               family: family[:name])
+          family: family[:name])
         route_int = nil
         if route_ending =~ /\bdev\s+([^\s]+)\b/
           route_int = $1

lib/ohai/plugins/passwd.rb

@@ -31,7 +31,7 @@ def fix_encoding(str)
 
       Etc.group do |entry|
         group_entry = Mash.new(gid: entry.gid,
-                               members: entry.mem.map { |u| fix_encoding(u) })
+          members: entry.mem.map { |u| fix_encoding(u) })
 
         etc[:group][fix_encoding(entry.name)] = group_entry
       end

lib/ohai/plugins/rackspace.rb

@@ -115,7 +115,7 @@ def get_region
   def get_instance_id
     so = shell_out("xenstore-read name")
     if so.exitstatus == 0
-      rackspace[:instance_id] = so.stdout.gsub(/instance-/, "")
+      rackspace[:instance_id] = so.stdout.gsub("instance-", "")
     end
   rescue Ohai::Exceptions::Exec
     logger.trace("Plugin Rackspace: Unable to find xenstore-read, cannot capture instance ID information for Rackspace cloud")

lib/ohai/provides_map.rb

@@ -65,8 +65,8 @@ def find_providers_for(attributes)
       plugins = []
       attributes.each do |attribute|
         attrs = select_subtree(@map, attribute)
-        raise Ohai::Exceptions::AttributeNotFound, "No such attribute: \'#{attribute}\'" unless attrs
-        raise Ohai::Exceptions::ProviderNotFound, "Cannot find plugin providing attribute: \'#{attribute}\'" unless attrs[:_plugins]
+        raise Ohai::Exceptions::AttributeNotFound, "No such attribute: '#{attribute}'" unless attrs
+        raise Ohai::Exceptions::ProviderNotFound, "Cannot find plugin providing attribute: '#{attribute}'" unless attrs[:_plugins]
 
         plugins += attrs[:_plugins]
       end
@@ -93,7 +93,7 @@ def deep_find_providers_for(attributes)
           attrs = select_closest_subtree(@map, attribute)
 
           unless attrs
-            raise Ohai::Exceptions::AttributeNotFound, "No such attribute: \'#{attribute}\'"
+            raise Ohai::Exceptions::AttributeNotFound, "No such attribute: '#{attribute}'"
           end
         end
 
@@ -115,10 +115,10 @@ def find_closest_providers_for(attributes)
       plugins = []
       attributes.each do |attribute|
         parts = normalize_and_validate(attribute)
-        raise Ohai::Exceptions::AttributeNotFound, "No such attribute: \'#{attribute}\'" unless @map[parts[0]]
+        raise Ohai::Exceptions::AttributeNotFound, "No such attribute: '#{attribute}'" unless @map[parts[0]]
 
         attrs = select_closest_subtree(@map, attribute)
-        raise Ohai::Exceptions::ProviderNotFound, "Cannot find plugin providing attribute: \'#{attribute}\'" unless attrs
+        raise Ohai::Exceptions::ProviderNotFound, "Cannot find plugin providing attribute: '#{attribute}'" unless attrs
 
         plugins += attrs[:_plugins]
       end

lib/ohai/runner.rb

@@ -119,9 +119,7 @@ def fetch_plugins(attributes)
     # cycle. Does not include plugins that aren't a part of the cycle
     def get_cycle(plugins, cycle_start)
       cycle = plugins.drop_while { |plugin| !plugin.eql?(cycle_start) }
-      names = []
-      cycle.each { |plugin| names << plugin.name }
-      names
+      cycle.map(&:name)
     end
 
   end

spec/unit/dsl/plugin_spec.rb

@@ -512,7 +512,9 @@
     end
 
     it "saves platforms across multiple plugins" do
-      plugin = Ohai.plugin(:Test) { collect_data {} }
+      # run ohai once for the default set of plugins
+      Ohai.plugin(:Test) { collect_data {} }
+      # then run just 2 plugins, and make sure the other plugins' data is preserved.
       plugin = Ohai.plugin(:Test) { collect_data(:aix, :sigar) {} }
       %i{aix default sigar}.each do |platform|
         expect(plugin.data_collector).to have_key(platform)

spec/unit/mixin/alibaba_metadata_spec.rb

@@ -184,4 +184,4 @@ def compare_tree(local, remote, need_sanitize = false)
     end
 
   end
-end
+end

spec/unit/mixin/oci_metadata_spec.rb

@@ -38,8 +38,8 @@
       allow(Net::HTTP).to receive(:start).with(Ohai::Mixin::OCIMetadata::OCI_METADATA_ADDR).and_return(http_mock)
 
       expect(http_mock).to receive(:get).with(Ohai::Mixin::OCIMetadata::OCI_METADATA_ADDR,
-                                              { "Authorization" => "Bearer Oracle",
-                                                "User-Agent" => "chef-ohai/#{Ohai::VERSION}" })
+        { "Authorization" => "Bearer Oracle",
+          "User-Agent" => "chef-ohai/#{Ohai::VERSION}" })
       mixin.http_get(Ohai::Mixin::OCIMetadata::OCI_METADATA_ADDR)
     end
   end

spec/unit/plugins/c_spec.rb

@@ -143,13 +143,13 @@
   context "when on Windows" do
     before do
       allow(plugin).to receive(:collect_os).and_return(:windows)
-      allow(plugin).to receive(:shell_out).with("cl /\?").and_return(mock_shell_out(0, "", C_CL))
-      allow(plugin).to receive(:shell_out).with("devenv.com /\?").and_return(mock_shell_out(0, C_VS, ""))
+      allow(plugin).to receive(:shell_out).with("cl /?").and_return(mock_shell_out(0, "", C_CL))
+      allow(plugin).to receive(:shell_out).with("devenv.com /?").and_return(mock_shell_out(0, C_VS, ""))
     end
 
     # ms cl
     it "gets the cl version from running cl /?" do
-      expect(plugin).to receive(:shell_out).with("cl /\?")
+      expect(plugin).to receive(:shell_out).with("cl /?")
       plugin.run
     end
 
@@ -164,21 +164,21 @@
     end
 
     it "does not set the languages[:c][:cl] tree up if cl command exits nonzero" do
-      allow(plugin).to receive(:shell_out).with("cl /\?").and_return(mock_shell_out(1, "", ""))
+      allow(plugin).to receive(:shell_out).with("cl /?").and_return(mock_shell_out(1, "", ""))
       plugin.run
       expect(plugin[:languages][:c]).not_to have_key(:cl)
     end
 
     it "does not set the languages[:c][:cl] tree up if cl command fails" do
-      allow(plugin).to receive(:shell_out).with("cl /\?").and_raise(Ohai::Exceptions::Exec)
+      allow(plugin).to receive(:shell_out).with("cl /?").and_raise(Ohai::Exceptions::Exec)
       plugin.run
       expect(plugin[:languages][:c]).not_to have_key(:cl)
       expect(plugin[:languages][:c]).not_to be_empty # expect other attributes
     end
 
     # ms vs
     it "gets the vs version from running devenv.com /?" do
-      expect(plugin).to receive(:shell_out).with("devenv.com /\?").and_return(mock_shell_out(0, C_VS, ""))
+      expect(plugin).to receive(:shell_out).with("devenv.com /?").and_return(mock_shell_out(0, C_VS, ""))
       plugin.run
     end
 
@@ -193,13 +193,13 @@
     end
 
     it "does not set the languages[:c][:vs] tree up if devenv command exits nonzero" do
-      allow(plugin).to receive(:shell_out).with("devenv.com /\?").and_return(mock_shell_out(1, "", ""))
+      allow(plugin).to receive(:shell_out).with("devenv.com /?").and_return(mock_shell_out(1, "", ""))
       plugin.run
       expect(plugin[:languages][:c]).not_to have_key(:vs)
     end
 
     it "does not set the languages[:c][:vs] tree up if devenv command fails" do
-      allow(plugin).to receive(:shell_out).with("devenv.com /\?").and_raise(Ohai::Exceptions::Exec)
+      allow(plugin).to receive(:shell_out).with("devenv.com /?").and_raise(Ohai::Exceptions::Exec)
       plugin.run
       expect(plugin[:languages][:c]).not_to have_key(:vs)
       expect(plugin[:languages][:c]).not_to be_empty # expect other attributes

spec/unit/plugins/darwin/virtualization_spec.rb

@@ -99,7 +99,7 @@
       expect(plugin[:virtualization][:systems][:docker]).to eq("host")
     end
 
-    it "sets vmware host if /Applications/VMware\ Fusion.app exists" do
+    it "sets vmware host if /Applications/VMware Fusion.app exists" do
       allow(plugin).to receive(:fusion_exists?).and_return(true)
       plugin.run
       expect(plugin[:virtualization][:system]).to eq("vmware")

spec/unit/plugins/grub2_spec.rb

@@ -26,10 +26,10 @@
   end
 
   it "populates grub2 if grub2-editenv is found" do
-    editenv_out = <<-EDITENV_OUT
-saved_entry=f4fd6be6243646e1a76a42d50f219818-5.2.9-229
-boot_success=1
-kernelopts=root=UUID=6db0ffcd-70ec-4333-86c3-873a9e2a0d77 ro
+    editenv_out = <<~EDITENV_OUT
+      saved_entry=f4fd6be6243646e1a76a42d50f219818-5.2.9-229
+      boot_success=1
+      kernelopts=root=UUID=6db0ffcd-70ec-4333-86c3-873a9e2a0d77 ro
     EDITENV_OUT
     allow(plugin).to receive(:which).with("grub2-editenv").and_return("/bin/grub2-editenv")
     allow(plugin).to receive(:shell_out).with("/bin/grub2-editenv list").and_return(mock_shell_out(0, editenv_out, ""))

spec/unit/plugins/kernel_spec.rb

@@ -24,15 +24,15 @@
     allow(@plugin).to receive(:collect_os).and_return(:default) # for debugging
     allow(@plugin).to receive(:shell_out).with("uname -s").and_return(mock_shell_out(0, "Darwin\n", ""))
     allow(@plugin).to receive(:shell_out).with("uname -r").and_return(mock_shell_out(0, "9.5.0\n", ""))
-    allow(@plugin).to receive(:shell_out).with("uname -v").and_return(mock_shell_out(0, "Darwin Kernel Version 9.5.0: Wed Sep  3 11:29:43 PDT 2008; root:xnu-1228.7.58~1\/RELEASE_I386\n", ""))
+    allow(@plugin).to receive(:shell_out).with("uname -v").and_return(mock_shell_out(0, "Darwin Kernel Version 9.5.0: Wed Sep  3 11:29:43 PDT 2008; root:xnu-1228.7.58~1/RELEASE_I386\n", ""))
     allow(@plugin).to receive(:shell_out).with("uname -m").and_return(mock_shell_out(0, "i386\n", ""))
     allow(@plugin).to receive(:shell_out).with("uname -o").and_return(mock_shell_out(0, "Linux\n", ""))
     allow(@plugin).to receive(:shell_out).with("uname -p").and_return(mock_shell_out(0, "i386\n", ""))
   end
 
   it_should_check_from_mash("kernel", "name", "uname -s", [0, "Darwin\n", ""])
   it_should_check_from_mash("kernel", "release", "uname -r", [0, "9.5.0\n", ""])
-  it_should_check_from_mash("kernel", "version", "uname -v", [0, "Darwin Kernel Version 9.5.0: Wed Sep  3 11:29:43 PDT 2008; root:xnu-1228.7.58~1\/RELEASE_I386\n", ""])
+  it_should_check_from_mash("kernel", "version", "uname -v", [0, "Darwin Kernel Version 9.5.0: Wed Sep  3 11:29:43 PDT 2008; root:xnu-1228.7.58~1/RELEASE_I386\n", ""])
   it_should_check_from_mash("kernel", "machine", "uname -m", [0, "i386\n", ""])
   it_should_check_from_mash("kernel", "processor", "uname -p", [0, "i386\n", ""])
 end