From 7623e7106a38e582022064bc4bb9b13fc3decf7b Mon Sep 17 00:00:00 2001 From: Josh Cooper Date: Tue, 12 May 2026 16:26:02 -0700 Subject: [PATCH 1/2] (PA-8346) Preserve sensitive parameters When converting Puppet::Resource to an instance of Puppet::Type, the list of sensitive_parameters was lost. So later Puppet::Parameter#sensitive returned false. There are multiple Puppet::Resource and Hash conversions taking place between the resource api and puppet: 1. resource-api calls Puppet::Resource#to_hash (line 78) 2. resource-api calls Puppet::Type#initialize(Hash) (line 108) 3. Puppet::Type#initialize calls hash2resource(Hash) returning Puppet::Resource[1] 4. Puppet::Type#initialize copies sensitive_parameters from Puppet::Resource to self[2] We have to ensure the list of sensistive_parameters is preserved through this call chain, so that the resulting Puppet::Parameter#sensitive instance variables are set correctly. [1] https://github.com/puppetlabs/puppet-private/blob/8361be778eb8bdda8b7335a98a4e7d11557f5f68/lib/puppet/type.rb#L2320 [2] https://github.com/puppetlabs/puppet-private/blob/8361be778eb8bdda8b7335a98a4e7d11557f5f68/lib/puppet/type.rb#L2347 Co-Authored-By: Claude Sonnet 4.6 --- lib/puppet/resource_api.rb | 3 ++- spec/puppet/resource_api_spec.rb | 27 +++++++++++++++++++++++++++ 2 files changed, 29 insertions(+), 1 deletion(-) diff --git a/lib/puppet/resource_api.rb b/lib/puppet/resource_api.rb index 3f2c2f46..c9d09bed 100644 --- a/lib/puppet/resource_api.rb +++ b/lib/puppet/resource_api.rb @@ -104,7 +104,8 @@ def initialize(attributes) attributes[:title] = @title if attributes[:title].nil? && !type_definition.namevars.empty? end - super + attributes[:sensitive_parameters] = sensitives unless sensitives.empty? + super(attributes) end # Override finish method to ensure scope tags (like class names) are properly inherited diff --git a/spec/puppet/resource_api_spec.rb b/spec/puppet/resource_api_spec.rb index 08d623bb..73fa53bd 100644 --- a/spec/puppet/resource_api_spec.rb +++ b/spec/puppet/resource_api_spec.rb @@ -498,6 +498,33 @@ def set(_context, _changes); end instance[:secret] = Puppet::Pops::Types::PSensitiveType::Sensitive.new('a new password') instance.flush end + + it 'marks the sensitive property with sensitive=true so it is excluded from the transaction store' do + expect(instance.parameter(:secret).sensitive).to be true + end + end + + context 'when loading from a Puppet::Resource with no sensitive parameters' do + let(:params) { instance_double('Puppet::Resource', 'resource') } + let(:provider_instance) { instance_double(provider_class, 'provider_instance') } + let(:catalog) { instance_double('Unknown', 'catalog') } + + before(:each) do + allow(provider_class).to receive(:new).with(no_args).and_return(provider_instance) + allow(provider_instance).to receive(:get).and_return([]) + allow(params).to receive(:is_a?).with(Puppet::Resource).and_return(true) + allow(params).to receive(:title).with(no_args).and_return('a title') + allow(params).to receive(:catalog).with(no_args).and_return(catalog) + allow(params).to receive(:sensitive_parameters).with(no_args).and_return([]) + allow(params).to receive(:to_hash).with(no_args) + .and_return(title: 'test', + secret: Puppet::Pops::Types::PSensitiveType::Sensitive.new('a password value')) + allow(catalog).to receive(:host_config?).and_return(true) + end + + it 'does not mark the property as sensitive' do + expect(instance.parameter(:secret).sensitive).not_to be true + end end end end From 481bb252cbcd5f98b052e84cd7afb145cedae948 Mon Sep 17 00:00:00 2001 From: tvpartytonight Date: Wed, 24 Jun 2026 14:08:01 -0700 Subject: [PATCH 2/2] (maint) Add in rubocop fixes for 1.9.x cherry picked commits --- lib/puppet/resource_api.rb | 2 +- spec/puppet/resource_api_spec.rb | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/puppet/resource_api.rb b/lib/puppet/resource_api.rb index c9d09bed..2f7aadcb 100644 --- a/lib/puppet/resource_api.rb +++ b/lib/puppet/resource_api.rb @@ -105,7 +105,7 @@ def initialize(attributes) end attributes[:sensitive_parameters] = sensitives unless sensitives.empty? - super(attributes) + super end # Override finish method to ensure scope tags (like class names) are properly inherited diff --git a/spec/puppet/resource_api_spec.rb b/spec/puppet/resource_api_spec.rb index 73fa53bd..f5c038bc 100644 --- a/spec/puppet/resource_api_spec.rb +++ b/spec/puppet/resource_api_spec.rb @@ -509,7 +509,7 @@ def set(_context, _changes); end let(:provider_instance) { instance_double(provider_class, 'provider_instance') } let(:catalog) { instance_double('Unknown', 'catalog') } - before(:each) do + before do allow(provider_class).to receive(:new).with(no_args).and_return(provider_instance) allow(provider_instance).to receive(:get).and_return([]) allow(params).to receive(:is_a?).with(Puppet::Resource).and_return(true)