(#14333) Ensure module permissions are sane.

Prior to this change, tarballs unpacked by the root user would be unpacked
with the permissions and the ownership information present in the tarball.
In the best case, this made some modules fail to function after installation
since the newly installed module was owned by a different user. In the worst
case, this could be seen as a fairly serious security vulnerability.

This change ensures that the module's permissions are always owner-writable,
world-readable, and that the owner is always the same as the module's parent
directory.
Backporting acceptance tests.
Merge pull request #1815 from pvande/PF-166-2.7.x

(#14333) Ensure module permissions are sane – 2.7.x backport.
Add debug_once to util/warnings

This function provides debounced logging for `Puppet.debug` similar to
`notice_once` and `warnonce`.
(#21835) Downgrade missing type optimization warn

For some catalogs, enabling `ignoremissingtypes` can produce a lot of noise in
the logs. This change downgrades the warning to a debug message and debounces
the logger so that messages appear only once per missing class or definition.
(Maint) Use dirname instead of regexes

A sequence of substitutions to strip off the trailing filename from a
path. This is actually just File.dirname in disguise.
(Maint) Clean up specs

The specs were distractingly bad. There was usage of instance variables
that were created in a loop, but caused the final value, which was used
by the tests, to not be what the author expected. This also pulls out
specific tests around how add() behaves in very important circumstances,
which the previous way of automatic test generation did not make clear.
(#21971) Check for possible directory traversal

The class name that is being looked for is translated to the directory
structure to search. In order to prevent directory traversal attacks we
need to make sure that the requested class name is valid and therefore
doesn't contain any directory traversal shortcuts.
(#21971) Split import and autoloading code paths

The codepaths for import and autoloading of manifest files were combined
at many levels, which made them share behaviors that were not wanted.
The import ability to load absolute paths leaked through into how
autoloading would try to find files for a particular class name, which
resulted in a possible vulnerability to injected class names (ENC
values, hiera data, etc). This splits those code paths to ensure that
the one used for autoloading only will ever look in modules that are
registered on the modulepath, while still allowing the import path to
look at absolute and relative file paths.
(#21971) Create system for safely dealing with path patterns

Correctly checking that a given string is safe to use for looking for
files on the filesystem is tricky. This adds a class called
Puppet::FileSystem::PathPattern that encapsulates a validated path
pattern free of defects such as directory traversal '..' entries and
zero byte delimeters. This is then used to protect finding manifest
files in modules.
(#21971) Fix TypeLoader#import_all on Ruby 1.8.7

Ruby 1.8.7's Find.find requires a block and returns nil.  This changes
the import_all implementation to insert acceptable files into a separate
list.
(#21971) Fixes PathPattern's usage of Dir.glob for Windows

Dir.glob seems to perform an impilicit to_s on what is passed.  Except
on Windows.  This change explicitly converts Pathname to a String, so we
don't have any surprises.
(#14333) Ensure module permissions are sane.

Prior to this change, tarballs unpacked by the root user would be unpacked
with the permissions and the ownership information present in the tarball.
In the best case, this made some modules fail to function after installation
since the newly installed module was owned by a different user. In the worst
case, this could be seen as a fairly serious security vulnerability.

This change ensures that the module's permissions are always owner-writable,
world-readable, and that the owner is always the same as the module's parent
directory.
Merge remote-tracking branch 'cve/security/3.2.3/21971-remote-execution-through-resource_type' into release_3.2.4

* cve/security/3.2.3/21971-remote-execution-through-resource_type:
  (#21971) Fixes PathPattern's usage of Dir.glob for Windows
  (#21971) Fix TypeLoader#import_all on Ruby 1.8.7
  (#21971) Create system for safely dealing with path patterns
  (#21971) Split import and autoloading code paths
  (#21971) Add test for accessing based on master being at root
  (#21971) Check for possible directory traversal
  (Maint) Clean up specs
  (Maint) Use dirname instead of regexes
  (#21971) Create test to show exploit of resource_type

Conflicts:
	lib/puppet/parser/type_loader.rb
	spec/unit/parser/type_loader_spec.rb
(#21953) Add test to verify module permissions

This patch adds a call to the helper method
assert_module_installed_on_disk
in the basic module install test.

The module helper module_utils.rb is added to support it. The
criteria for validating that the module has been properly applied
to disk are as follows:

    * The containing directory for the module has a mode of 755
    * The Modulefile for hte module has a mode of 644
    * The owner of the containing directory for the module is
      the same as the `moduledir` that it is installed into.
    * The group of the containing directory for the module is
      the same as the `moduledir` that it is installed into.

The assert_module_installed_on_disk validates the above criteria.
Merge branch 'PF-166' into release_3.2.4

* PF-166:
  (#14333) Ensure module permissions are sane.
Merge branch '21953_PMT_Permissions' into release_3.2.4

* 21953_PMT_Permissions:
  (#21953) Add test to verify module permissions
(Maint) Reinstate check for manifest dir

The check that a manifest directory exists seems to have been lost
during a merge at some point. This puts the check back in for import_all
Fixing a missed test for minitar.

This test wasn't updated when the signature of #unpack was changed, which was
causing the tests to fail. The test now sends appropriate arguments to
the method.
(#21971) Allow paths that contain .. as part of a name

The PathPattern code was incorrectly flagging paths like /tmp/foo..bar
as being directory traversals. This updates that to exclude those names
by checking each path component separately instead of looking at the
path as a whole.

In addition this fixes up the error reporting about these kinds of
errors in Puppet::Module by creating the absolute PathPattern for the
manifests directory of the module at initialization time, so that any
errors from it are not swallowed by the error handling for the relative
path searching of manifests.

This also removed some duplicate handling of init.pp and init.rb where
in the case of having no pattern to search for the init files were
returned twice and also seemed to be loaded twice. This does not remove
the behavior in which the init.pp and rb files are *always* returned
when they exist, because that seems to be explicit behavior added for
issue #4220.