Class: Inspec::Rule

Inherits:
Object
  • Object
show all
Includes:
RSpec::Matchers
Defined in:
lib/inspec/rule.rb

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(id, profile_id, opts, &block) ⇒ Rule

Returns a new instance of Rule.



32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
 
# File 'lib/inspec/rule.rb', line 32

def initialize(id, profile_id, opts, &block)
  @impact = nil
  @title = nil
  @desc = nil
  @refs = []
  @tags = {}

  # not changeable by the user:
  @__block = block
  @__source_location = __get_block_source_location(&block)
  @__rule_id = id
  @__profile_id = profile_id
  @__checks = []
  @__skip_rule = nil
  @__merge_count = 0
  @__merge_changes = []
  @__skip_only_if_eval = opts[:skip_only_if_eval]

  # evaluate the given definition
  return unless block_given?
  begin
    instance_eval(&block)
  rescue StandardError => e
    # We've encountered an exception while trying to eval the code inside the
    # control block. We need to prevent the exception from bubbling up, and
    # fail the control. Controls are failed by having a failed resource within
    # them; but since our control block is unsafe (and opaque) to us, let's
    # make a dummy and fail that.
    location = block.source_location.compact.join(':')
    describe 'Control Source Code Error' do
      # Rubocop thinks we are raising an exception - we're actually calling RSpec's fail()
      its(location) { fail e.message } # rubocop: disable Style/SignalException
    end
  end
end

Class Method Details

.checks(rule) ⇒ Object 



169
170
171
 
# File 'lib/inspec/rule.rb', line 169

def self.checks(rule)
  rule.instance_variable_get(:@__checks)
end

.merge(dst, src) ⇒ Object

rubocop:disable Metrics/AbcSize



201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
 
# File 'lib/inspec/rule.rb', line 201

def self.merge(dst, src) # rubocop:disable Metrics/AbcSize
  if src.id != dst.id
    # TODO: register an error, this case should not happen
    return
  end
  sp = rule_id(src)
  dp = rule_id(dst)
  if sp != dp
    # TODO: register an error, this case should not happen
    return
  end
  # merge all fields
  dst.impact(src.impact) unless src.impact.nil?
  dst.title(src.title)   unless src.title.nil?
  dst.desc(src.desc)     unless src.desc.nil?
  dst.tag(src.tag)       unless src.tag.nil?
  dst.ref(src.ref)       unless src.ref.nil?

  # merge indirect fields
  # checks defined in the source will completely eliminate
  # all checks that were defined in the destination
  sc = checks(src)
  dst.instance_variable_set(:@__checks, sc) unless sc.empty?
  sr = skip_status(src)
  set_skip_rule(dst, sr) unless sr.nil?

  # Save merge history
  dst.instance_variable_set(:@__merge_count, merge_count(dst) + 1)
  dst.instance_variable_set(
    :@__merge_changes,
    merge_changes(dst) << src.instance_variable_get(:@__source_location),
  )
end

.merge_changes(rule) ⇒ Object 



185
186
187
 
# File 'lib/inspec/rule.rb', line 185

def self.merge_changes(rule)
  rule.instance_variable_get(:@__merge_changes)
end

.merge_count(rule) ⇒ Object 



181
182
183
 
# File 'lib/inspec/rule.rb', line 181

def self.merge_count(rule)
  rule.instance_variable_get(:@__merge_count)
end

.prepare_checks(rule) ⇒ Object 



189
190
191
192
193
194
195
196
197
198
199
 
# File 'lib/inspec/rule.rb', line 189

def self.prepare_checks(rule)
  msg = skip_status(rule)
  return checks(rule) unless msg
  msg = 'Skipped control due to only_if condition.' if msg == true

  # TODO: we use os as the carrier here, but should consider
  # a separate resource to do skipping
  resource = rule.os
  resource.skip_resource(msg)
  [['describe', [resource], nil]]
end

.profile_id(rule) ⇒ Object 



165
166
167
 
# File 'lib/inspec/rule.rb', line 165

def self.profile_id(rule)
  rule.instance_variable_get(:@__profile_id)
end

.resource_dsl ⇒ Object

rubocop:disable Style/TrivialAccessors



28
29
30
 
# File 'lib/inspec/rule.rb', line 28

def self.resource_dsl # rubocop:disable Style/TrivialAccessors
  @resource_dsl
end

.rule_id(rule) ⇒ Object 



157
158
159
 
# File 'lib/inspec/rule.rb', line 157

def self.rule_id(rule)
  rule.instance_variable_get(:@__rule_id)
end

.set_rule_id(rule, value) ⇒ Object 



161
162
163
 
# File 'lib/inspec/rule.rb', line 161

def self.set_rule_id(rule, value)
  rule.instance_variable_set(:@__rule_id, value)
end

.set_skip_rule(rule, value) ⇒ Object 



177
178
179
 
# File 'lib/inspec/rule.rb', line 177

def self.set_skip_rule(rule, value)
  rule.instance_variable_set(:@__skip_rule, value)
end

.skip_status(rule) ⇒ Object 



173
174
175
 
# File 'lib/inspec/rule.rb', line 173

def self.skip_status(rule)
  rule.instance_variable_get(:@__skip_rule)
end

.with_resource_dsl(resource_dsl) ⇒ Object

Include any resources from the given resource DSL. The passed resource_dsl will also be included in any Inspec::Expect objects we make.



22
23
24
25
26
 
# File 'lib/inspec/rule.rb', line 22

def self.with_resource_dsl(resource_dsl)
  include resource_dsl
  @resource_dsl = resource_dsl
  true
end

Instance Method Details

#desc(v = nil) ⇒ Object 



87
88
89
90
 
# File 'lib/inspec/rule.rb', line 87

def desc(v = nil)
  @desc = unindent(v) unless v.nil?
  @desc
end

#describe(*values, &block) ⇒ nil|DescribeBase

Describe will add one or more tests to this control. There is 2 ways of calling it:

describe resource do ... end

or

describe.one do ... end

Parameters:

  • Resource (any) —

    to be describe, string, or nil

  • An (Proc) —

    optional block containing tests for the described resource

Returns:

  • (nil|DescribeBase) —

    if called without arguments, returns DescribeBase



140
141
142
143
144
145
146
147
148
149
 
# File 'lib/inspec/rule.rb', line 140

def describe(*values, &block)
  if values.empty? && !block_given?
    dsl = self.class.ancestors[1]
    Class.new(DescribeBase) do
      include dsl
    end.new(method(:__add_check))
  else
    __add_check('describe', values, with_dsl(block))
  end
end

#expect(value, &block) ⇒ Object 



151
152
153
154
155
 
# File 'lib/inspec/rule.rb', line 151

def expect(value, &block)
  target = Inspec::Expect.new(value, &with_dsl(block))
  __add_check('expect', [value], target)
  target
end

#id(*_) ⇒ Object 



72
73
74
75
 
# File 'lib/inspec/rule.rb', line 72

def id(*_)
  # never overwrite the ID
  @id
end

#impact(v = nil) ⇒ Object 



77
78
79
80
 
# File 'lib/inspec/rule.rb', line 77

def impact(v = nil)
  @impact = v unless v.nil?
  @impact
end

#only_if ⇒ nil

Skip all checks if only_if is false

Parameters:

  • &block (Type) —

    returns true if tests are added, false otherwise

Returns:

  • (nil) 


121
122
123
124
125
126
 
# File 'lib/inspec/rule.rb', line 121

def only_if
  return unless block_given?
  return if @__skip_only_if_eval == true

  @__skip_rule ||= !yield
end

#ref(ref = nil, opts = {}) ⇒ Object 



92
93
94
95
96
97
98
99
100
 
# File 'lib/inspec/rule.rb', line 92

def ref(ref = nil, opts = {})
  return @refs if ref.nil? && opts.empty?
  if opts.empty? && ref.is_a?(Hash)
    opts = ref
  else
    opts[:ref] = ref
  end
  @refs.push(opts)
end

#source_file ⇒ Object 



113
114
115
 
# File 'lib/inspec/rule.rb', line 113

def source_file
  @__file
end

#tag(*args) ⇒ Object 



102
103
104
105
106
107
108
109
110
111
 
# File 'lib/inspec/rule.rb', line 102

def tag(*args)
  args.each do |arg|
    if arg.is_a?(Hash)
      @tags.merge!(arg)
    else
      @tags[arg] ||= nil
    end
  end
  @tags
end

#title(v = nil) ⇒ Object 



82
83
84
85
 
# File 'lib/inspec/rule.rb', line 82

def title(v = nil)
  @title = v unless v.nil?
  @title
end

#to_s ⇒ Object 



68
69
70
 
# File 'lib/inspec/rule.rb', line 68

def to_s
  Inspec::Rule.rule_id(self)
end