rodjek/librarian-puppet — pull request #182 by ringods (2014-03-03 15:20:59+00:00)
Title: Sanitize the environment before spawning

Secure coding guidelines advice to [sanitize the environment before spawning child processes](https://www.securecoding.cert.org/confluence/display/seccode/ENV03-C.+Sanitize+the+environment+when+invoking+external+programs).

In this case, having a ``GEM_PATH`` defined in the parent process has influence on the execution of the spawned ``puppet`` process:

```
C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require': cannot load such file -- win32/dir (LoadError)
from C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'
from C:/Tools/Puppet/facter/lib/facter/util/config.rb:44:in `'
from C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'
from C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'
from C:/Tools/Puppet/facter/lib/facter/util/resolution.rb:7:in `'
from C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'
from C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'
from C:/Tools/Puppet/facter/lib/facter/util/fact.rb:2:in `'
from C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'
from C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'
from C:/Tools/Puppet/facter/lib/facter.rb:23:in `'
from C:/Tools/Puppet/facter/lib/facter.rb:19:in `'
from C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'
from C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'
from C:/Tools/Puppet/puppet/lib/puppet.rb:6:in `'
from C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'
from C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'
from C:/Tools/Puppet/puppet/lib/puppet/util/command_line.rb:12:in `'
from C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'
from C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'
from C:/Tools/Puppet/puppet/bin/puppet:3:in `

'
```

When unsetting the ``GEM_PATH``, it works flawlessly:

```
$ irb
1.9.3-p484 :001 > require 'open3'
=> true
1.9.3-p484 :002 > result = Open3.popen3('puppet --version')
=> [#, #, #, #]
1.9.3-p484 :003 > result[2].read
=> "C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require': cannot load such file -- win32/dir (LoadError)\r\n\tfrom C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'\r\n\tfrom C:/Tools/Puppet/facter/lib/facter/util/config.rb:44:in `'\r\n\tfrom C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'\r\n\tfrom C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'\r\n\tfrom C:/Tools/Puppet/facter/lib/facter/util/resolution.rb:7:in `'\r\n\tfrom C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'\r\n\tfrom C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'\r\n\tfrom C:/Tools/Puppet/facter/lib/facter/util/fact.rb:2:in `'\r\n\tfrom C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'\r\n\tfrom C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'\r\n\tfrom C:/Tools/Puppet/facter/lib/facter.rb:23:in `'\r\n\tfrom C:/Tools/Puppet/facter/lib/facter.rb:19:in `'\r\n\tfrom C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'\r\n\tfrom C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'\r\n\tfrom C:/Tools/Puppet/puppet/lib/puppet.rb:6:in `'\r\n\tfrom C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'\r\n\tfrom C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'\r\n\tfrom C:/Tools/Puppet/puppet/lib/puppet/util/command_line.rb:12:in `'\r\n\tfrom C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'\r\n\tfrom C:/Tools/Puppet/sys/ruby/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require'\r\n\tfrom C:/Tools/Puppet/puppet/bin/puppet:3:in `

'\r\n"
1.9.3-p484 :004 > result = Open3.popen3({"GEM_PATH"=> nil}, 'puppet --version')
=> [#, #, #, #]
1.9.3-p484 :005 > result[2].read
=> ""
1.9.3-p484 :006 > result[1].read
=> "3.3.1\n"
1.9.3-p484 :007 >
```