Merge pull request #286 from chef/security-fixes-to-release5

Security fixes

Author: ashiqueps

.github/workflows/sonarqube.yml

@@ -1,4 +1,6 @@
 name: SonarQube scan
+permissions:
+  contents: read
 on:
   # Trigger analysis when pushing to your main branches, and when creating a pull request.
   push:

lib/chef-cli/policyfile/comparison_base.rb

@@ -43,7 +43,7 @@ def lock
           raise LockfileNotFound, "Expected lockfile at #{policyfile_lock_relpath} does not exist" unless File.exist?(policyfile_lock_relpath)
           raise LockfileNotFound, "Expected lockfile at #{policyfile_lock_relpath} cannot be read" unless File.readable?(policyfile_lock_relpath)
 
-          FFI_Yajl::Parser.parse(IO.read(policyfile_lock_relpath))
+          FFI_Yajl::Parser.parse(File.read(policyfile_lock_relpath))
         rescue FFI_Yajl::ParseError => e
           raise MalformedLockfile, "Invalid JSON in lockfile at #{policyfile_lock_relpath}:\n  #{e.message}"
         end

lib/chef-cli/policyfile/local_lock_fetcher.rb

@@ -102,7 +102,7 @@ def transform_path(path_to_transform)
       end
 
       def content
-        IO.read(path)
+        File.read(path)
       end
 
       def path

lib/chef-cli/policyfile/undo_stack.rb

@@ -109,7 +109,7 @@ def undo_file_for(id)
       end
 
       def load_undo_record(file)
-        data = FFI_Yajl::Parser.parse(IO.read(file))
+        data = FFI_Yajl::Parser.parse(File.read(file))
         UndoRecord.new.load(data)
       end
 

lib/chef-cli/policyfile_lock.rb

@@ -64,7 +64,7 @@ def cookbook_version_width
       end
     end
 
-    RUN_LIST_ITEM_FORMAT = /\Arecipe\[[^\s]+::[^\s]+\]\Z/
+    RUN_LIST_ITEM_FORMAT = /\Arecipe\[([^:\s][^:\s]{0,254})::([^:\s][^:\s]{0,254})\]\Z/
 
     def self.build(storage_config)
       lock = new(storage_config)

lib/chef-cli/policyfile_services/export_repo.rb

@@ -78,7 +78,7 @@ def run
       end
 
       def policy_data
-        @policy_data ||= FFI_Yajl::Parser.parse(IO.read(policyfile_lock_expanded_path))
+        @policy_data ||= FFI_Yajl::Parser.parse(File.read(policyfile_lock_expanded_path))
       rescue => error
         raise PolicyfileExportRepoError.new("Error reading lockfile #{policyfile_lock_expanded_path}", error)
       end

lib/chef-cli/policyfile_services/install.rb

@@ -69,7 +69,7 @@ def run(cookbooks_to_update = [], exclude_deps = false)
       end
 
       def policyfile_content
-        @policyfile_content ||= IO.read(policyfile_expanded_path)
+        @policyfile_content ||= File.read(policyfile_expanded_path)
       end
 
       def policyfile_compiler
@@ -81,7 +81,7 @@ def expanded_run_list
       end
 
       def policyfile_lock_content
-        @policyfile_lock_content ||= IO.read(policyfile_lock_expanded_path) if File.exist?(policyfile_lock_expanded_path)
+        @policyfile_lock_content ||= File.read(policyfile_lock_expanded_path) if File.exist?(policyfile_lock_expanded_path)
       end
 
       def policyfile_lock

lib/chef-cli/policyfile_services/push.rb

@@ -57,7 +57,7 @@ def http_client
       end
 
       def policy_data
-        @policy_data ||= FFI_Yajl::Parser.parse(IO.read(policyfile_lock_expanded_path))
+        @policy_data ||= FFI_Yajl::Parser.parse(File.read(policyfile_lock_expanded_path))
       rescue => error
         raise PolicyfilePushError.new("Error reading lockfile #{policyfile_lock_expanded_path}", error)
       end

lib/chef-cli/policyfile_services/push_archive.rb

@@ -120,7 +120,7 @@ def read_policyfile_lock(staging_dir)
       end
 
       def load_policy_data(policyfile_lock_path)
-        FFI_Yajl::Parser.parse(IO.read(policyfile_lock_path))
+        FFI_Yajl::Parser.parse(File.read(policyfile_lock_path))
       end
 
       def stage_unpacked_archive

lib/chef-cli/policyfile_services/update_attributes.rb

@@ -74,15 +74,15 @@ def updated_lock?
       end
 
       def policyfile_content
-        @policyfile_content ||= IO.read(policyfile_expanded_path)
+        @policyfile_content ||= File.read(policyfile_expanded_path)
       end
 
       def policyfile_compiler
         @policyfile_compiler ||= ChefCLI::PolicyfileCompiler.evaluate(policyfile_content, policyfile_expanded_path, ui:, chef_config:)
       end
 
       def policyfile_lock_content
-        @policyfile_lock_content ||= IO.read(policyfile_lock_expanded_path)
+        @policyfile_lock_content ||= File.read(policyfile_lock_expanded_path)
       end
 
       def policyfile_lock