Class: RuboCop::Cop::Chef::Security::InsecureRemoteFileSource

Inherits:
Base
  • Object
show all
Includes:
RuboCop::Chef::CookbookHelpers
Defined in:
lib/rubocop/cop/chef/security/insecure_remote_file_source.rb

Overview

Files downloaded over plain HTTP or FTP can be modified in transit, and the resource will use whatever it receives. Fetch them over HTTPS so the transport is authenticated.

Where an HTTPS endpoint genuinely isn't available, a checksum on the resource at least detects tampering, since the digest is compared before the file is used.

Examples:


# bad
remote_file '/tmp/foo.tar.gz' do
  source 'http://example.com/foo.tar.gz'
end

# good
remote_file '/tmp/foo.tar.gz' do
  source 'https://example.com/foo.tar.gz'
end

Constant Summary collapse

MSG = 
'Fetch remote files over HTTPS. A file downloaded over plain HTTP or FTP can be modified in transit and the resource will use whatever it receives.'
RESOURCES =

the resources that download a file from the source property

%i(remote_file windows_package msu_package dmg_package cab_package).freeze
INSECURE_SCHEME =

transports with no authentication of the server or the payload

%r{\A(?:http|ftp)://}i.freeze

Instance Method Summary collapse

Methods included from RuboCop::Chef::CookbookHelpers

#each_action_symbol, #match_property_in_resource?, #match_resource_type?, #method_arg_ast_to_string, #resource_block_name_if_string

Methods inherited from Base

#target_chef_version

Instance Method Details

#on_block(node) ⇒ Object 



51
52
53
54
55
56
57
58
59
 
# File 'lib/rubocop/cop/chef/security/insecure_remote_file_source.rb', line 51

def on_block(node)
  match_property_in_resource?(RESOURCES, 'source', node) do |source|
    source.arguments.each do |argument|
      # remote_file also accepts an array of mirrors, any one of which may be insecure
      urls = argument.array_type? ? argument.values : [argument]
      urls.each { |url| add_offense(url, severity: :warning) if insecure_url?(url) }
    end
  end
end