(#18986) Write to the console using Unicode Win32 APIs

Previously, puppet on windows could not output unicode characters to the
console reliably, such as the box drawing characters used by the module
tool when displaying dependencies.

Ruby 1.8 uses the ANSI Win32 APIs, e.g. WriteConsole, to write to the
console. However, it uses the current console codepage. So if the current
codepage cannot handle the unicode character we're trying to write, e.g.
cp1252, then it displays garbage.

Ruby 1.9 uses the Unicode Win32 APIs, e.g. WriteConsoleW. As such, it can
correctly write unicode output, without being sensitive to the current
codepage.

However, because puppet writes ANSI escape sequences, we use the
win32console gem to color the output. This win32console gem redefines the
stdout and stderr streams to accomplish this, and sadly uses ANSI versions
of Win32 APIs to write to the console. So it has the same problems as ruby
1.8.

This commit overrides the win32console classes, Console and IO, to ensure
the Unicode APIs are used. This enables us to display ANSI escape
sequences and unicode characters that may not be compatible with the
current codepage.

Longer term we should think about removing win32console gem altogether and
moving to ruby 1.9, as these hacks would no longer be required. Though
doing so would mean losing color output, or taking more drastic measures
like ansicon.
(maint) Use MatchData object over ruby global vars

The implementation for native file headers for the ParsedFile providers
made use of the Perl style global variables like $`, $', and $&. These
are difficult to understand at first glance and equivalent behavior is
provided by MatchData objects. This commit removes the global variables
with a MatchData object for clarity.
(#19393) Safely load YAML from the network

When using Psych (only available in Ruby 1.9), YAML.load may in certain
cases (!map: and !ruby/hash: tags) use the initialize and []= methods to
create objects. These methods could potentially allow arbitrary code to
be executed. We now add a safely_load method which parses the input
first, checks it for dangerous tags, and fails if they are found. If the
input is clean, we transform the result (as YAML.load would have done)
and go on our merry way.

This change is only applied to YAML coming in either HTTP requests or
responses. YAML from the local system is trusted, as anyone who can
write that YAML could do damage some other way.
(#19393) Safely load YAML from the network

When using Psych (only available in Ruby 1.9), YAML.load may in certain
cases (!map: and !ruby/hash: tags) use the initialize and []= methods to
create objects. These methods could potentially allow arbitrary code to
be executed. We now add a safely_load method which parses the input
first, checks it for dangerous tags, and fails if they are found. If the
input is clean, we transform the result (as YAML.load would have done)
and go on our merry way.

This change is only applied to YAML coming in either HTTP requests or
responses. YAML from the local system is trusted, as anyone who can
write that YAML could do damage some other way.
Merge remote-tracking branch 'puppet-cve-test/safely-yaml-3.1.0' into security/3.1.0/february_code_orange

* puppet-cve-test/safely-yaml-3.1.0:
  (#19393) Safely load YAML from the network
Merge pull request #1489 from adrienthebo/maint/master/parsedfile-human-readable-match-variables

(maint) Use MatchData object over ruby global vars
(#14093) Cleanup tests for template functionality

Some of the previous tests were unneeded (check for simple existance) or
mis-named. This cleans those up. A few other tests were trying to
indirectly test many things at once (the ones about access to instance
variables). Instead of the indirect test this splits it into much more
specific tests and statement of behavior.
(#14093) Remove unsafe attributes from TemplateWrapper

The attribute accessor for the :string attribute in the TemplateWrapper
conflicted with a variable being in scope that is named string. The
variable would take precedence and because of the way the
TemplateWrapper accessed the value of the attribute, the variable's
value would be used as the template.

This changes the TemplateWrapper to completely remove :string as an
attribute and only use local variables. This also removes the :file
attribute in favor of a "private"-style naming of the instance variable.
There are no collisions with @__file__ that would cause problems, but
this should reduce the likelihood of them happening in the first place.
(Maint) Remove special handling for symbols in scope

The Puppet::Parser::Scope no longer allows variable names that are not
String objects, so the extra code to handle non-string variable names is
no longer needed.
(#14093) Restore access to the filename in the template

The change to fix certain variables interfering with template evaluation
also removed the accessor method for file. It appears that this is a
mechanism that had been used by others for identifying the name of the
template being evaluated so that they can trace back from a file on a
node to the module and template that created it. This restores that
functionality.
(Maint) Add YARD to TemplateWrapper

This tries to document the methods that should be available to template
authors. Not all methods are listed, since there may be some things that
are mixed in somehow and there are all of the variable accesses provided
via method_missing.
(maint) Kill Puppet::Parser::TemplateWrapper#scope=

This is dead code that is never called based on `ack` and replacing the
method body with an thrown exception.  The scope instance var is stored
in @__scope__ not @scope.
Merge branch 'zaphod42-issue/master/14093-string-overrides-all-template-output'

* zaphod42-issue/master/14093-string-overrides-all-template-output:
  (maint) Kill Puppet::Parser::TemplateWrapper#scope=
  (Maint) Add YARD to TemplateWrapper
  (#14093) Restore access to the filename in the template
  (Maint) Remove special handling for symbols in scope
  (#14093) Remove unsafe attributes from TemplateWrapper
  (#14093) Cleanup tests for template functionality
Merge pull request #11 from puppetlabs/safely-yaml

(#19393) Safely load YAML from the network
(#14093) Cleanup tests for template functionality

Some of the previous tests were unneeded (check for simple existance) or
mis-named. This cleans those up. A few other tests were trying to
indirectly test many things at once (the ones about access to instance
variables). Instead of the indirect test this splits it into much more
specific tests and statement of behavior.
(#14093) Remove unsafe attributes from TemplateWrapper

The attribute accessor for the :string attribute in the TemplateWrapper
conflicted with a variable being in scope that is named string. The
variable would take precedence and because of the way the
TemplateWrapper accessed the value of the attribute, the variable's
value would be used as the template.

This changes the TemplateWrapper to completely remove :string as an
attribute and only use local variables. This also removes the :file
attribute in favor of a "private"-style naming of the instance variable.
There are no collisions with @__file__ that would cause problems, but
this should reduce the likelihood of them happening in the first place.
(maint) Add some YARD to Puppet::Forge
(#19409) Raise Puppet::Forge::Errors::ForgeError on bad HTTP response from forge

When a bad HTTP response indicating an error, or an "error" string in the
response is received from the forge, raise Puppet::Forge::Errors::ForgeError
subclases rather than RuntimeErrors.

This allows the error to be caught by the module face and the error rendered
appropriately, i.e. as JSON if requested by the user.  Else fallback code for
unhandled exceptions is used, causing the exception to only be written via
logging.
Merge pull request #1492 from domcleal/tickets/master/19409-module-errors

(#19409) Raise Puppet::Forge::Error::ForgeError on bad HTTP response from forge
(#14093) Restore access to the filename in the template

The change to fix certain variables interfering with template evaluation
also removed the accessor method for file. It appears that this is a
mechanism that had been used by others for identifying the name of the
template being evaluated so that they can trace back from a file on a
node to the module and template that created it. This restores that
functionality.