Merge pull request #1 from jhelwig/remove-eval

Safely deserialize stringified array

1 files changed, 6 insertions, 10 deletions

diff --git a/lib/puppet/provider/augeas/augeas.rb b/lib/puppet/provider/augeas/augeas.rb
index 05183e5..ee52ee6 100644
--- a/lib/puppet/provider/augeas/augeas.rb
+++ b/lib/puppet/provider/augeas/augeas.rb
@@ -18,12 +18,13 @@ require 'strscan'
 require 'puppet/util'
 require 'puppet/util/diff'
 require 'puppet/util/package'
-require 'json'
+require 'puppet_x/augeas/util/parser'
 
 Puppet::Type.type(:augeas).provide(:augeas) do
   include Puppet::Util
   include Puppet::Util::Diff
   include Puppet::Util::Package
+  include PuppetX::Augeas::Util::Parser
 
   confine feature: :augeas
 
@@ -281,7 +282,7 @@ Puppet::Type.type(:augeas).provide(:augeas) do
     when '=='
       begin
         arg = clause_array.shift
-        new_array = to_array(arg)
+        new_array = parse_to_array(arg)
         return_value = (values == new_array)
       rescue
         fail(_('Invalid array in command: %{cmd}') % { cmd: cmd_array.join(' ') })
@@ -289,7 +290,7 @@ Puppet::Type.type(:augeas).provide(:augeas) do
     when '!='
       begin
         arg = clause_array.shift
-        new_array = to_array(arg)
+        new_array = parse_to_array(arg)
         return_value = (values != new_array)
       rescue
         fail(_('Invalid array in command: %{cmd}') % { cmd: cmd_array.join(' ') })
@@ -337,7 +338,7 @@ Puppet::Type.type(:augeas).provide(:augeas) do
     when '=='
       begin
         arg = clause_array.shift
-        new_array = to_array(arg)
+        new_array = parse_to_array(arg)
         return_value = (result == new_array)
       rescue
         fail(_('Invalid array in command: %{cmd}') % { cmd: cmd_array.join(' ') })
@@ -345,7 +346,7 @@ Puppet::Type.type(:augeas).provide(:augeas) do
     when '!='
       begin
         arg = clause_array.shift
-        new_array = to_array(arg)
+        new_array = parse_to_array(arg)
         return_value = (result != new_array)
       rescue
         fail(_('Invalid array in command: %{cmd}') % { cmd: cmd_array.join(' ') })
@@ -572,9 +573,4 @@ Puppet::Type.type(:augeas).provide(:augeas) do
     end
   end
   # rubocop:enable Style/GuardClause
-
-  def to_array(string)
-    JSON.parse(string.tr("'", '"'))
-  end
-  private :to_array
 end