(#294) Fix missing hyphen in tag name

Hyphen is allowed in tag names, but was being stripped by a broken
regular expression. It needs escaping to be treated literally.

This fixes #294.
Adds protection against injection attacks to the nodejs layer

The nodejs layer of the Razor back-end was wide open to injection attacks. Not
only did all commands perform shell expansion of the command line, some paths
where also directly mapped to the file system without first checking if they
contained '..' segments. I had no problems letting Razor server up my private
ssh key for instance. This commits adds some code to prevent injection attacks
from happening. It consist of the following:
1. All calls to exec() has been replaced by calls to execFile() to avoid shell
   expansion.
2. When the execFile results in errors, those errors are now handled. They
   were previously ignored.
3. Splitting, decoding, and validation of request path was refactored into one
   function.
4. A new exception type InvalidURIPathError was introduced.
5. All path segments are checked for length (<200 characters) and validated
   with a regexp that ensures that they don't contain any control characters.
6. Several tests were added to verify that some known types of injection
   attacks are trapped.
Changed all instances of "invert" in tag.rb to "inverse" to work properly with the tag matching capability of both Razor and puppetlabs-razor
Prevents web access to the Razor config

One of the points in the security assessment of Razor was
"Unauthenticated access to Razor configuration file".

This commit ensures that this file cannot be accessed using
the web interface by letting the Ruby CLI preventing access
to the 'config' slice for all calls using the -w flag.

A new flag, '-j' was introduced to enable the nodejs layer
to obtain the config in json format. The Ruby CLI will block
all attemts to combine the -w and -j flags.

The prevention check was added to the Ruby layer rather than
in the nodejs layer for two reasons:
1. There are ongoing discussions about replacing nodejs.
2. The check would have been added for all http methods. In
   the Ruby CLI, it was enough to add it in one place.

A more elaborate solution where the check was moved into the
'config' slice was considered but rejected because I wanted
to keep the alteration as limited (and thus easy to review)
as possible.

The commit also contains some tests to verify that the config
is impossible to obtain using the web.
Handle platforms with "purged" packages in git install test

When we validate that packages refuse to install over the top of an existing
git-based deployment, we end up with a package that isn't installed.

Unfortunately, that is represented by two distinct states in Puppet, `absent`
and `purged`, with only a subset of platforms supporting the later state, and
even then, only sometimes reporting it.

This means that the test was broken in the real world: it reported `absent` on
my test bench, but put into production it reported `purged`, and we
incorrectly decided that the package was installed when it actually wasn't.

This makes the obvious update to the check, so that we handle both cases, and
should fix the acceptance test failure after #322 merged.

Signed-off-by: Daniel Pittman <daniel@rimspace.net>
Merge pull request #385 from daniel-pittman/feature/master/322-refuse-to-install-over-git-deployments

Handle platforms with "purged" packages in git install test
Define confdir in redhat spec

In commit 0fd1f7c, init scripts were added for Razor, and packaging artifacts
were updated to install them. However, as written, the redhat spec file
attempts to install the init script using a macro '%{confdir}' that is not
defined. This causes rpm packaging to fail, because the path to the init script
is invalid.  This commit defines the missing %{confdir} macro as ext/redhat so
that the install succeeds and package build completes. This solution was chosen
over just hardcoding the path 'ext/redhat' because macros are generally more
reusable and maintainable, but in this case it feels like a toss-up since we
use this path only once.
Merge pull request #386 from MosesMendoza/define_confidr_in_redhat_spec

Define confdir in redhat spec
Update internal package repository layout

This updates the acceptance tests to handle the new "consistent snapshot of
internal package repositories" process, in conjunction with our
CI infrastructure.

Essentially, the CI system captures the version of the internal Razor packages
we are testing at the start of the run, and the acceptance suite then uses
that consistent snapshot for the entire run.

This avoids a problem where you could wind up with the package versions
changing between the start of an acceptance run and the end of the same run,
triggered when, for example, we commit multiple pull requests in
quick succession.

This shouldn't have any user-visible change outside our own testing and
package release process.

Signed-off-by: Daniel Pittman <daniel@rimspace.net>
Merge pull request #389 from daniel-pittman/feature/master/388-handle-updated-internal-package-repo-layout

Update internal package repository layout
Merge pull request #308 from tdb/bug/master/294-fix-hypen-in-tag-name

(#294) Fix missing hyphen in tag name
Merge pull request #362 from virtualswede/32f0b31045c5f77e1016a7b255459a5bc73e8d66

Changed all instances of "invert" in tag.rb to "inverse" to work properly with the tag matching capability of both Razor and puppetlabs-razor < new pull request
Fix tests after fixing invert vs inverse tag matching

In #294 we fixed a problem where invert vs inverse were used in tag matching,
and they led to inconsistent results as we set one but looked for the other.

Fixing that went well, but a couple of tests were missed, and the result was a
broken system.  This fixes the missed tests, and should clean up the results.

Signed-off-by: Daniel Pittman <daniel@rimspace.net>
Merge pull request #391 from daniel-pittman/bug/master/294-missed-invert-to-inverse-changes

Fix tests after fixing invert vs inverse tag matching
(#383) Added postinstall script to kickstart.erb

This change adds the necessary lines at the bottom of the kickstart.erb
template for Red Hat 6 so that the postinstall script is called on
reboot. This is done by downloading the script to the /tmp/postinstall.sh
file, making it executable and adding a line to the rc.local so that
it's eventually called. The code is inspired from other preseed files
for Ubuntu that essentially do the same thing.

The change is necessary because, otherwise, the provisioning process
never even gets to the point of informing the broker. This affected
RHEL 6, CentOS 6 and other distributions based on Red Hat 6.
Merge pull request #384 from cr3/383

(#383) Added lines to the kickstart.erb on redhat/6 to setup the postinstall script to be called by rc.local.
Update internal package Microkernel ISO location

This migrates the Microkernel ISO image from the older layout to the new,
atomic-snapshot publication model.  That mirrors the same change in the
internal packages, and applies in the same circumstances.

This integrates the acceptance suite with the same testing and promotion
model, which should make it easier to automate publication.

Signed-off-by: Daniel Pittman <daniel@rimspace.net>
Merge pull request #392 from daniel-pittman/feature/master/388-handle-updated-internal-package-repo-layout

Update internal package Microkernel ISO location
Merge pull request #1 from thallgren/bug/master/nodejs-security

Bug/master/nodejs security
New download path for Microkernel images