2017-05-01 18:02:15 +00:00
|
|
|
# encoding: utf-8
|
2017-06-29 15:01:32 +00:00
|
|
|
|
|
|
|
require 'hashie/mash'
|
|
|
|
require 'utils/database_helpers'
|
|
|
|
require 'htmlentities'
|
|
|
|
require 'rexml/document'
|
|
|
|
require 'csv'
|
2017-05-01 18:02:15 +00:00
|
|
|
|
|
|
|
module Inspec::Resources
|
2017-06-29 15:01:32 +00:00
|
|
|
# STABILITY: Experimental
|
|
|
|
# This resource needs further testing and refinement
|
|
|
|
#
|
2017-05-05 17:11:07 +00:00
|
|
|
class OracledbSession < Inspec.resource(1)
|
|
|
|
name 'oracledb_session'
|
2018-02-19 14:26:49 +00:00
|
|
|
supports platform: 'unix'
|
|
|
|
supports platform: 'windows'
|
2017-05-05 17:11:07 +00:00
|
|
|
desc 'Use the oracledb_session InSpec resource to test commands against an Oracle database'
|
2017-05-01 18:02:15 +00:00
|
|
|
example "
|
2017-05-05 17:11:07 +00:00
|
|
|
sql = oracledb_session(user: 'my_user', pass: 'password')
|
2017-06-29 15:01:32 +00:00
|
|
|
describe sql.query(\"SELECT UPPER(VALUE) AS VALUE FROM V$PARAMETER WHERE UPPER(NAME)='AUDIT_SYS_OPERATIONS'\").row(0).column('value') do
|
|
|
|
its('value') { should eq 'TRUE' }
|
2017-05-01 18:02:15 +00:00
|
|
|
end
|
|
|
|
"
|
|
|
|
|
2017-06-29 15:01:32 +00:00
|
|
|
attr_reader :user, :password, :host, :service
|
2017-05-05 13:29:38 +00:00
|
|
|
def initialize(opts = {})
|
|
|
|
@user = opts[:user]
|
2017-06-29 15:01:32 +00:00
|
|
|
@password = opts[:password] || opts[:pass]
|
|
|
|
if opts[:pass]
|
|
|
|
warn '[DEPRECATED] use `password` option to supply password instead of `pass`'
|
|
|
|
end
|
|
|
|
|
2017-05-05 14:11:53 +00:00
|
|
|
@host = opts[:host] || 'localhost'
|
2017-06-29 15:01:32 +00:00
|
|
|
@port = opts[:port] || '1521'
|
|
|
|
@service = opts[:service]
|
|
|
|
|
|
|
|
# we prefer sqlci although it is way slower than sqlplus, but it understands csv properly
|
|
|
|
@sqlcl_bin = 'sql'
|
2017-05-05 14:11:53 +00:00
|
|
|
@sqlplus_bin = opts[:sqlplus_bin] || 'sqlplus'
|
2017-06-29 15:01:32 +00:00
|
|
|
|
|
|
|
return skip_resource "Can't run Oracle checks without authentication" if @user.nil? || @password.nil?
|
|
|
|
return skip_resource 'You must provide a service name for the session' if @service.nil?
|
2017-05-01 18:02:15 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def query(q)
|
2017-05-05 13:29:38 +00:00
|
|
|
escaped_query = q.gsub(/\\/, '\\\\').gsub(/"/, '\\"')
|
2017-06-29 15:01:32 +00:00
|
|
|
# escape tables with $
|
|
|
|
escaped_query = escaped_query.gsub('$', '\\$')
|
|
|
|
|
|
|
|
p = nil
|
2017-08-14 18:57:51 +00:00
|
|
|
# use sqlplus if sqlcl is not available
|
|
|
|
if inspec.command(@sqlcl_bin).exist?
|
2017-06-29 15:01:32 +00:00
|
|
|
bin = @sqlcl_bin
|
|
|
|
opts = "set sqlformat csv\nSET FEEDBACK OFF"
|
|
|
|
p = :parse_csv_result
|
2017-08-14 18:57:51 +00:00
|
|
|
else
|
|
|
|
bin = @sqlplus_bin
|
|
|
|
opts = "SET MARKUP HTML ON\nSET FEEDBACK OFF"
|
|
|
|
p = :parse_html_result
|
2017-06-29 15:01:32 +00:00
|
|
|
end
|
|
|
|
|
2017-11-15 20:49:09 +00:00
|
|
|
query = verify_query(escaped_query)
|
|
|
|
query += ';' unless query.end_with?(';')
|
|
|
|
command = %{echo "#{opts}\n#{query}\nEXIT" | #{bin} "#{@user}"/"#{@password}"@#{@host}:#{@port}/#{@service}}
|
2017-06-29 15:01:32 +00:00
|
|
|
cmd = inspec.command(command)
|
|
|
|
|
2017-05-01 18:02:15 +00:00
|
|
|
out = cmd.stdout + "\n" + cmd.stderr
|
|
|
|
if out.downcase =~ /^error/
|
2017-06-29 15:01:32 +00:00
|
|
|
# TODO: we need to throw an exception here
|
|
|
|
# change once https://github.com/chef/inspec/issues/1205 is in
|
|
|
|
warn "Could not execute the sql query #{out}"
|
|
|
|
DatabaseHelper::SQLQueryResult.new(cmd, Hashie::Mash.new({}))
|
2017-05-01 18:02:15 +00:00
|
|
|
end
|
2017-06-29 15:01:32 +00:00
|
|
|
DatabaseHelper::SQLQueryResult.new(cmd, send(p, cmd.stdout))
|
2017-05-01 18:02:15 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def to_s
|
|
|
|
'Oracle Session'
|
|
|
|
end
|
2017-06-29 15:01:32 +00:00
|
|
|
|
|
|
|
private
|
|
|
|
|
|
|
|
def verify_query(query)
|
|
|
|
# ensure we have a ; at the end
|
|
|
|
query + ';' if !query.strip.end_with?(';')
|
|
|
|
query
|
|
|
|
end
|
|
|
|
|
|
|
|
def parse_csv_result(stdout)
|
|
|
|
output = stdout.delete(/\r/)
|
|
|
|
table = CSV.parse(output, { headers: true })
|
|
|
|
|
|
|
|
# convert to hash
|
|
|
|
headers = table.headers
|
|
|
|
|
|
|
|
results = table.map { |row|
|
|
|
|
res = {}
|
|
|
|
headers.each { |header|
|
|
|
|
res[header.downcase] = row[header]
|
|
|
|
}
|
|
|
|
Hashie::Mash.new(res)
|
|
|
|
}
|
|
|
|
results
|
|
|
|
end
|
|
|
|
|
|
|
|
def parse_html_result(stdout) # rubocop:disable Metrics/AbcSize
|
|
|
|
result = stdout
|
|
|
|
# make oracle html valid html by removing the p tag, it does not include a closing tag
|
|
|
|
result = result.gsub('<p>', '').gsub('</p>', '').gsub('<br>', '')
|
|
|
|
doc = REXML::Document.new result
|
|
|
|
table = doc.elements['table']
|
|
|
|
hash = []
|
|
|
|
if !table.nil?
|
|
|
|
rows = table.elements.to_a
|
|
|
|
headers = rows[0].elements.to_a('th').map { |entry| entry.text.strip }
|
|
|
|
rows.delete_at(0)
|
|
|
|
|
|
|
|
# iterate over each row, first row is header
|
|
|
|
hash = []
|
|
|
|
if !rows.nil? && !rows.empty?
|
|
|
|
hash = rows.map { |row|
|
|
|
|
res = {}
|
|
|
|
entries = row.elements.to_a('td')
|
|
|
|
# ignore if we have empty entries, oracle is adding th rows in between
|
|
|
|
return nil if entries.empty?
|
|
|
|
headers.each_with_index { |header, index|
|
|
|
|
# we need htmlentities since we do not have nokogiri
|
|
|
|
coder = HTMLEntities.new
|
|
|
|
val = coder.decode(entries[index].text).strip
|
|
|
|
res[header.downcase] = val
|
|
|
|
}
|
|
|
|
Hashie::Mash.new(res)
|
|
|
|
}.compact
|
|
|
|
end
|
|
|
|
end
|
|
|
|
hash
|
|
|
|
end
|
2017-05-01 18:02:15 +00:00
|
|
|
end
|
2017-05-02 15:03:45 +00:00
|
|
|
end
|