Default chef attributes value may lead to accessing nil.

[arlimus]

Using "Option 2: Use the chef node object" to pull in chef attributes may lead to code like this:

chef_node['a']['b']['c'] == 'd'

During an inspec check the value of chef_node by default is {} which lead to accessing [] from nil.

Proposed solution: Use a mesh that always returns something accessible by default.

[arlimus]

This is caused due to the desription in this readme:
https://github.com/chef-cookbooks/audit/tree/4ca2bc44be58fac1080a9907960934e357a33fda#option-2-use-the-chef-node-object

One solution to this problem may be:

default_attributes = {}
default_attributes.default_proc=->(a,_){a}
chef_node = attribute('chef_node', description: 'Chef Node', default: default_attributes)

It's not pretty at all, but it works.

We could also predefine it somewhere and just call it. Or let inspec get a default for {} which maps this behavior:

chef_node = attribute('chef_node', description: 'Chef Node', type: :hash)

[adamleff]

This doesn't feel like an audit cookbook problem, it feels like an InSpec problem. Since we don't support the passing of attributes during a check (and I don't think we should), I wonder if we should consider stubbing out the attribute DSL method during a check to a simple object with a method_missing with splat args (*args) and just return that object back so anything that tries to call methods on it is a bit safer.

[arlimus]

@adamleff Fully agreed. Hide the implementation, maybe respect types.... moving this to InSpec.
Leaving this issue open since the description will need a change once we are done so that the default value is not {} anymore. (it should just be removed when the problem is solved in inspec)