remove 'rexml/document' to get rid of a random ordering keys in uwsgi xml config and notifications for restart service
move service and change notifies to subscribes
change init.d to upstart
Merge pull request #789 from dirkmueller/release/roxy/master

+1
Merge pull request #800 from MirantisDellCrowbar/bug/config-uwsgi/master

fix generating uwsgi config
Fix when syntax in node_object
Fix unexpected return in application controller
Fix breakage due to change of hash.select API between ruby 1.8 and 1.9
Use more concise syntax for converting hash to array of [key,val] pairs
Fix cmd injection in SupportController#logs

Pass arguments to system separately, to prevent shell expansion.

False positive - system() arg comes from a safe location.
Fix cmd injection in SupportController#get_cli

Pass arguments to system separately, to prevent shell
expansion.

This is probably a false positive, but at least on one occasion [1], a web
server was overwriting the SERVER_ADDR with a user supplied header, so this
prevents such bugs from affecting us.

[1] https://thin.lighthouseapp.com/projects/7212/tickets/112-thin-shouldnt-set-server_addr-with-the-value-of-x-forwarded-for
Fix cmd injection in NodeObject#bmc_cmd

Pass arguments to system separately, to prevent shell
expansion.

Whenever a node user would be named '|| rm -rf /;', obvious thing would happen.
Not sure if this is exploitable from outside, though.
Fix command injections in service object

Pass arguments to system separately, to prevent shell
expansion.

This is a false positive, all arguments come from our code.
hint for intended roles
Merge pull request #811 from bkutil/ruby19-syntax-fix

Ruby 1.9 compatibility fixes
Fix cmd injection in SupportController#export_chef

Pass arguments to system separately, to prevent shell
expansion.

This is a false positive, input comes from our code.
Fix cmd injection in NodeObject#bmc_cmd

Pass arguments to system separately, to prevent shell
expansion.

Giving a node a special name could lead to cmd execution here.
Not sure if this is exploitable from outside, though.
Replace Marshal dump+load w/ deep clone method, refactor calls

Marshal can unserialize specially crafted strings to a class, on which the user
might attempt to call arbitrary methods.

This should be a false positive, as we call only methods defined by us on the
cloned object and the unserialized value itself is probably not user supplied.

Anyway, use a deep_copy method that won't contain the special unserializing
magic.
Add Open3.popen3 wrapper that replaces ` and %x

%x() and ` allows shell expansion, similarly to system(cmd).

The alternative is to use popen3 and return its output.
Use the Cmd wrapper instead of backticks and %x

Cmd wrapper does not suffer from shell expansion.

As long as external users cannot supply their own specially crafted docs, the
first occurence is a false positive.

The second is in unreachable code.