summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJoseph Larionov <30190605+decoyjoe@users.noreply.github.com>2022-11-01 12:37:58 -0700
committerGitHub <noreply@github.com>2022-11-01 15:37:58 -0400
commitc4ce765dc71a2ad1762ce5c43f0e245a17909378 (patch)
treee4fac5f2b105844d97673e60e983c77649bfda9f
parent117e74ccbd1a00b6fca7da4687a68feb995b7977 (diff)
downloadchef-c4ce765dc71a2ad1762ce5c43f0e245a17909378.tar.gz
Bugfix: checksum validation (#13210)
* Add a case-insensitive helper to determine if two checksums match * Use case-insensitive checksum match helper for checksum validation This fixes a bug where checksum validation fails because the two checksums are in different letter cases. The existing checksum validation logic was using case sensitive equality checks. Signed-off-by: Joseph Larionov <jlarionov@webmd.net>
-rw-r--r--lib/chef/mixin/checksum.rb6
-rw-r--r--lib/chef/provider/file.rb4
-rw-r--r--lib/chef/provider/package/windows.rb2
-rw-r--r--spec/unit/mixin/checksum_spec.rb28
4 files changed, 37 insertions, 3 deletions
diff --git a/lib/chef/mixin/checksum.rb b/lib/chef/mixin/checksum.rb
index 083e524d63..10ecac0b36 100644
--- a/lib/chef/mixin/checksum.rb
+++ b/lib/chef/mixin/checksum.rb
@@ -31,6 +31,12 @@ class Chef
checksum.slice(0, 6)
end
+
+ def checksum_match?(ref_checksum, diff_checksum)
+ return false if ref_checksum.nil? || diff_checksum.nil?
+
+ ref_checksum.casecmp?(diff_checksum)
+ end
end
end
end
diff --git a/lib/chef/provider/file.rb b/lib/chef/provider/file.rb
index 4ac86a6c8a..02611af4eb 100644
--- a/lib/chef/provider/file.rb
+++ b/lib/chef/provider/file.rb
@@ -336,7 +336,7 @@ class Chef
end
def do_validate_content
- if new_resource.checksum && tempfile && ( new_resource.checksum != tempfile_checksum )
+ if new_resource.checksum && tempfile && !checksum_match?(new_resource.checksum, tempfile_checksum)
raise Chef::Exceptions::ChecksumMismatch.new(short_cksum(new_resource.checksum), short_cksum(tempfile_checksum))
end
@@ -450,7 +450,7 @@ class Chef
def contents_changed?
logger.trace "calculating checksum of #{tempfile.path} to compare with #{current_resource.checksum}"
- tempfile_checksum != current_resource.checksum
+ !checksum_match?(tempfile_checksum, current_resource.checksum)
end
def tempfile
diff --git a/lib/chef/provider/package/windows.rb b/lib/chef/provider/package/windows.rb
index 4350eb6d12..5581469062 100644
--- a/lib/chef/provider/package/windows.rb
+++ b/lib/chef/provider/package/windows.rb
@@ -38,7 +38,7 @@ class Chef
def define_resource_requirements
if new_resource.checksum
requirements.assert(:install) do |a|
- a.assertion { new_resource.checksum == checksum(source_location) }
+ a.assertion { checksum_match?(new_resource.checksum, checksum(source_location)) }
a.failure_message Chef::Exceptions::Package, "Checksum on resource (#{short_cksum(new_resource.checksum)}) does not match checksum on content (#{short_cksum(source_location)})"
end
end
diff --git a/spec/unit/mixin/checksum_spec.rb b/spec/unit/mixin/checksum_spec.rb
index e8fb1ed4dc..9c1e19769d 100644
--- a/spec/unit/mixin/checksum_spec.rb
+++ b/spec/unit/mixin/checksum_spec.rb
@@ -51,4 +51,32 @@ describe Chef::Mixin::Checksum do
end
end
+ describe "checksum_match?" do
+ context "when checksum cases match" do
+ it "returns true" do
+ expect(@checksum_user.checksum_match?("u7ghbxikk3i9blsimmy2y2ionmxx", "u7ghbxikk3i9blsimmy2y2ionmxx")).to be true
+ end
+ end
+
+ context "when one checksum is uppercase and other is lowercase" do
+ it "returns true" do
+ expect(@checksum_user.checksum_match?("U7GHBXIKK3I9BLSIMMY2Y2IONMXX", "u7ghbxikk3i9blsimmy2y2ionmxx")).to be true
+ end
+ end
+
+ context "when checksums do not match" do
+ it "returns false" do
+ expect(@checksum_user.checksum_match?("u7ghbxikk3i9blsimmy2y2ionmxx", "09ee9c8cc70501763563bcf9c218")).to be false
+ end
+ end
+
+ context "when checksum is nil" do
+ it "returns false" do
+ expect(@checksum_user.checksum_match?("u7ghbxikk3i9blsimmy2y2ionmxx", nil)).to be false
+ expect(@checksum_user.checksum_match?(nil, "09ee9c8cc70501763563bcf9c218")).to be false
+ expect(@checksum_user.checksum_match?(nil, nil)).to be false
+ end
+ end
+ end
+
end