diff --git a/lib/puppet/indirector.rb b/lib/puppet/indirector.rb
index e6472f4d9..fd6bf3010 100644
--- a/lib/puppet/indirector.rb
+++ b/lib/puppet/indirector.rb
@@ -1,71 +1,78 @@
 # Manage indirections to termini.  They are organized in terms of indirections -
 # - e.g., configuration, node, file, certificate -- and each indirection has one
 # or more terminus types defined.  The indirection is configured via the
 # +indirects+ method, which will be called by the class extending itself
 # with this module.
 module Puppet::Indirector
   # LAK:FIXME We need to figure out how to handle documentation for the
   # different indirection types.
 
   require 'puppet/indirector/indirection'
   require 'puppet/indirector/terminus'
   require 'puppet/indirector/envelope'
   require 'puppet/network/format_handler'
 
   # Declare that the including class indirects its methods to
   # this terminus.  The terminus name must be the name of a Puppet
   # default, not the value -- if it's the value, then it gets
   # evaluated at parse time, which is before the user has had a chance
   # to override it.
   def indirects(indirection, options = {})
     raise(ArgumentError, "Already handling indirection for #{@indirection.name}; cannot also handle #{indirection}") if @indirection
     # populate this class with the various new methods
     extend ClassMethods
     include InstanceMethods
     include Puppet::Indirector::Envelope
     extend Puppet::Network::FormatHandler
 
     # instantiate the actual Terminus for that type and this name (:ldap, w/ args :node)
     # & hook the instantiated Terminus into this class (Node: @indirection = terminus)
     @indirection = Puppet::Indirector::Indirection.new(self, indirection,  options)
   end
 
   module ClassMethods
     attr_reader :indirection
 
     def cache_class=(klass)
       indirection.cache_class = klass
     end
 
     def terminus_class=(klass)
       indirection.terminus_class = klass
     end
 
     # Expire any cached instance.
     def expire(*args)
       indirection.expire(*args)
     end
 
     def find(*args)
       indirection.find(*args)
     end
 
     def head(*args)
       indirection.head(*args)
     end
 
     def destroy(*args)
       indirection.destroy(*args)
     end
 
     def search(*args)
       indirection.search(*args)
     end
   end
 
   module InstanceMethods
     def save(key = nil)
       self.class.indirection.save key, self
     end
   end
+
+
+  # Helper definition for indirections that handle filenames.
+  BadNameRegexp = Regexp.union(/^\.\./,
+                               %r{[\\/]},
+                               "\0",
+                               /(?i)^[a-z]:/)
 end
diff --git a/lib/puppet/indirector/ssl_file.rb b/lib/puppet/indirector/ssl_file.rb
index 531180f5b..45104999a 100644
--- a/lib/puppet/indirector/ssl_file.rb
+++ b/lib/puppet/indirector/ssl_file.rb
@@ -1,174 +1,178 @@
 require 'puppet/ssl'
 
 class Puppet::Indirector::SslFile < Puppet::Indirector::Terminus
   # Specify the directory in which multiple files are stored.
   def self.store_in(setting)
     @directory_setting = setting
   end
 
   # Specify a single file location for storing just one file.
   # This is used for things like the CRL.
   def self.store_at(setting)
     @file_setting = setting
   end
 
   # Specify where a specific ca file should be stored.
   def self.store_ca_at(setting)
     @ca_setting = setting
   end
 
   class << self
     attr_reader :directory_setting, :file_setting, :ca_setting
   end
 
   # The full path to where we should store our files.
   def self.collection_directory
     return nil unless directory_setting
     Puppet.settings[directory_setting]
   end
 
   # The full path to an individual file we would be managing.
   def self.file_location
     return nil unless file_setting
     Puppet.settings[file_setting]
   end
 
   # The full path to a ca file we would be managing.
   def self.ca_location
     return nil unless ca_setting
     Puppet.settings[ca_setting]
   end
 
   # We assume that all files named 'ca' are pointing to individual ca files,
   # rather than normal host files.  It's a bit hackish, but all the other
   # solutions seemed even more hackish.
   def ca?(name)
     name == Puppet::SSL::Host.ca_name
   end
 
   def initialize
     Puppet.settings.use(:main, :ssl)
 
     (collection_directory || file_location) or raise Puppet::DevError, "No file or directory setting provided; terminus #{self.class.name} cannot function"
   end
 
-  # Use a setting to determine our path.
   def path(name)
+    if name =~ Puppet::Indirector::BadNameRegexp then
+      Puppet.crit("directory traversal detected in #{self.class}: #{name.inspect}")
+      raise ArgumentError, "invalid key"
+    end
+
     if ca?(name) and ca_location
       ca_location
     elsif collection_directory
       File.join(collection_directory, name.to_s + ".pem")
     else
       file_location
     end
   end
 
   # Remove our file.
   def destroy(request)
     path = path(request.key)
     return false unless FileTest.exist?(path)
 
     Puppet.notice "Removing file #{model} #{request.key} at '#{path}'"
     begin
       File.unlink(path)
     rescue => detail
       raise Puppet::Error, "Could not remove #{request.key}: #{detail}"
     end
   end
 
   # Find the file on disk, returning an instance of the model.
   def find(request)
     path = path(request.key)
 
     return nil unless FileTest.exist?(path) or rename_files_with_uppercase(path)
 
     result = model.new(request.key)
     result.read(path)
     result
   end
 
   # Save our file to disk.
   def save(request)
     path = path(request.key)
     dir = File.dirname(path)
 
     raise Puppet::Error.new("Cannot save #{request.key}; parent directory #{dir} does not exist") unless FileTest.directory?(dir)
     raise Puppet::Error.new("Cannot save #{request.key}; parent directory #{dir} is not writable") unless FileTest.writable?(dir)
 
     write(request.key, path) { |f| f.print request.instance.to_s }
   end
 
   # Search for more than one file.  At this point, it just returns
   # an instance for every file in the directory.
   def search(request)
     dir = collection_directory
     Dir.entries(dir).reject { |file| file !~ /\.pem$/ }.collect do |file|
       name = file.sub(/\.pem$/, '')
       result = model.new(name)
       result.read(File.join(dir, file))
       result
     end
   end
 
   private
 
   # Demeterish pointers to class info.
   def collection_directory
     self.class.collection_directory
   end
 
   def file_location
     self.class.file_location
   end
 
   def ca_location
     self.class.ca_location
   end
 
   # A hack method to deal with files that exist with a different case.
   # Just renames it; doesn't read it in or anything.
   # LAK:NOTE This is a copy of the method in sslcertificates/support.rb,
   # which we'll be EOL'ing at some point.  This method was added at 20080702
   # and should be removed at some point.
   def rename_files_with_uppercase(file)
     dir, short = File.split(file)
     return nil unless FileTest.exist?(dir)
 
     raise ArgumentError, "Tried to fix SSL files to a file containing uppercase" unless short.downcase == short
     real_file = Dir.entries(dir).reject { |f| f =~ /^\./ }.find do |other|
       other.downcase == short
     end
 
     return nil unless real_file
 
     full_file = File.join(dir, real_file)
 
     Puppet.notice "Fixing case in #{full_file}; renaming to #{file}"
     File.rename(full_file, file)
 
     true
   end
 
   # Yield a filehandle set up appropriately, either with our settings doing
   # the work or opening a filehandle manually.
   def write(name, path)
     if ca?(name) and ca_location
       Puppet.settings.write(self.class.ca_setting) { |f| yield f }
     elsif file_location
       Puppet.settings.write(self.class.file_setting) { |f| yield f }
     elsif setting = self.class.directory_setting
       begin
         Puppet.settings.writesub(setting, path) { |f| yield f }
       rescue => detail
         raise Puppet::Error, "Could not write #{path} to #{setting}: #{detail}"
       end
     else
       raise Puppet::DevError, "You must provide a setting to determine where the files are stored"
     end
   end
 end
 
 # LAK:NOTE This has to be at the end, because classes like SSL::Key use this
 # class, and this require statement loads those, which results in a load loop
 # and lots of failures.
 require 'puppet/ssl/host'
diff --git a/lib/puppet/indirector/yaml.rb b/lib/puppet/indirector/yaml.rb
index 23997e97a..4c488da62 100644
--- a/lib/puppet/indirector/yaml.rb
+++ b/lib/puppet/indirector/yaml.rb
@@ -1,65 +1,70 @@
 require 'puppet/indirector/terminus'
 require 'puppet/util/file_locking'
 
 # The base class for YAML indirection termini.
 class Puppet::Indirector::Yaml < Puppet::Indirector::Terminus
   include Puppet::Util::FileLocking
 
   # Read a given name's file in and convert it from YAML.
   def find(request)
     file = path(request.key)
     return nil unless FileTest.exist?(file)
 
     yaml = nil
     begin
       readlock(file) { |fh| yaml = fh.read }
     rescue => detail
       raise Puppet::Error, "Could not read YAML data for #{indirection.name} #{request.key}: #{detail}"
     end
     begin
       return from_yaml(yaml)
     rescue => detail
       raise Puppet::Error, "Could not parse YAML data for #{indirection.name} #{request.key}: #{detail}"
     end
   end
 
   # Convert our object to YAML and store it to the disk.
   def save(request)
     raise ArgumentError.new("You can only save objects that respond to :name") unless request.instance.respond_to?(:name)
 
     file = path(request.key)
 
     basedir = File.dirname(file)
 
     # This is quite likely a bad idea, since we're not managing ownership or modes.
     Dir.mkdir(basedir) unless FileTest.exist?(basedir)
 
     begin
       writelock(file, 0660) { |f| f.print to_yaml(request.instance) }
     rescue TypeError => detail
       Puppet.err "Could not save #{self.name} #{request.key}: #{detail}"
     end
   end
 
   # Return the path to a given node's file.
   def path(name,ext='.yaml')
+    if name =~ Puppet::Indirector::BadNameRegexp then
+      Puppet.crit("directory traversal detected in #{self.class}: #{name.inspect}")
+      raise ArgumentError, "invalid key"
+    end
+
     base = Puppet.run_mode.master? ? Puppet[:yamldir] : Puppet[:clientyamldir]
     File.join(base, self.class.indirection_name.to_s, name.to_s + ext)
   end
 
   def search(request)
     Dir.glob(path(request.key,'')).collect do |file|
       YAML.load_file(file)
     end
   end
 
   private
 
   def from_yaml(text)
     YAML.load(text)
   end
 
   def to_yaml(object)
     YAML.dump(object)
   end
 end
diff --git a/spec/unit/indirector/ssl_file_spec.rb b/spec/unit/indirector/ssl_file_spec.rb
index 37098a7a9..4760bd7b2 100755
--- a/spec/unit/indirector/ssl_file_spec.rb
+++ b/spec/unit/indirector/ssl_file_spec.rb
@@ -1,281 +1,300 @@
 #!/usr/bin/env ruby
 #
 #  Created by Luke Kanies on 2008-3-10.
 #  Copyright (c) 2007. All rights reserved.
 
 require File.dirname(__FILE__) + '/../../spec_helper'
 
 require 'puppet/indirector/ssl_file'
 
 describe Puppet::Indirector::SslFile do
   before do
     @model = mock 'model'
     @indirection = stub 'indirection', :name => :testing, :model => @model
     Puppet::Indirector::Indirection.expects(:instance).with(:testing).returns(@indirection)
     @file_class = Class.new(Puppet::Indirector::SslFile) do
       def self.to_s
         "Testing::Mytype"
       end
     end
 
     @setting = :certdir
     @file_class.store_in @setting
     @path = "/tmp/my_directory"
     Puppet[:noop] = false
     Puppet[@setting] = @path
     Puppet[:trace] = false
   end
 
   it "should use :main and :ssl upon initialization" do
     Puppet.settings.expects(:use).with(:main, :ssl)
     @file_class.new
   end
 
   it "should return a nil collection directory if no directory setting has been provided" do
     @file_class.store_in nil
     @file_class.collection_directory.should be_nil
   end
 
   it "should return a nil file location if no location has been provided" do
     @file_class.store_at nil
     @file_class.file_location.should be_nil
   end
 
   it "should fail if no store directory or file location has been set" do
     @file_class.store_in nil
     @file_class.store_at nil
     lambda { @file_class.new }.should raise_error(Puppet::DevError)
   end
 
   describe "when managing ssl files" do
     before do
       Puppet.settings.stubs(:use)
       @searcher = @file_class.new
 
       @cert = stub 'certificate', :name => "myname"
       @certpath = File.join(@path, "myname.pem")
 
       @request = stub 'request', :key => @cert.name, :instance => @cert
     end
 
     it "should consider the file a ca file if the name is equal to what the SSL::Host class says is the CA name" do
       Puppet::SSL::Host.expects(:ca_name).returns "amaca"
       @searcher.should be_ca("amaca")
     end
 
     describe "when choosing the location for certificates" do
       it "should set them at the ca setting's path if a ca setting is available and the name resolves to the CA name" do
         @file_class.store_in nil
         @file_class.store_at :mysetting
         @file_class.store_ca_at :casetting
 
         Puppet.settings.stubs(:value).with(:casetting).returns "/ca/file"
 
         @searcher.expects(:ca?).with(@cert.name).returns true
         @searcher.path(@cert.name).should == "/ca/file"
       end
 
       it "should set them at the file location if a file setting is available" do
         @file_class.store_in nil
         @file_class.store_at :mysetting
 
         Puppet.settings.stubs(:value).with(:mysetting).returns "/some/file"
 
         @searcher.path(@cert.name).should == "/some/file"
       end
 
       it "should set them in the setting directory, with the certificate name plus '.pem', if a directory setting is available" do
         @searcher.path(@cert.name).should == @certpath
       end
+
+      ['../foo', '..\\foo', './../foo', '.\\..\\foo',
+       '/foo', '//foo', '\\foo', '\\\\goo',
+       "test\0/../bar", "test\0\\..\\bar",
+       "..\\/bar", "/tmp/bar", "/tmp\\bar", "tmp\\bar",
+       " / bar", " /../ bar", " \\..\\ bar",
+       "c:\\foo", "c:/foo", "\\\\?\\UNC\\bar", "\\\\foo\\bar",
+       "\\\\?\\c:\\foo", "//?/UNC/bar", "//foo/bar",
+       "//?/c:/foo",
+      ].each do |input|
+        it "should resist directory traversal attacks (#{input.inspect})" do
+          expect { @searcher.path(input) }.to raise_error
+        end
+      end
+
+      # REVISIT: Should probably test MS-DOS reserved names here, too, since
+      # they would represent a vulnerability on a Win32 system, should we ever
+      # support that path.  Don't forget that 'CON.foo' == 'CON'
+      # --daniel 2011-09-24
     end
 
     describe "when finding certificates on disk" do
       describe "and no certificate is present" do
         before do
           # Stub things so the case management bits work.
           FileTest.stubs(:exist?).with(File.dirname(@certpath)).returns false
           FileTest.expects(:exist?).with(@certpath).returns false
         end
 
         it "should return nil" do
           @searcher.find(@request).should be_nil
         end
       end
 
       describe "and a certificate is present" do
         before do
           FileTest.expects(:exist?).with(@certpath).returns true
         end
 
         it "should return an instance of the model, which it should use to read the certificate" do
           cert = mock 'cert'
           model = mock 'model'
           @file_class.stubs(:model).returns model
 
           model.expects(:new).with("myname").returns cert
           cert.expects(:read).with(@certpath)
           @searcher.find(@request).should equal(cert)
         end
       end
 
       describe "and a certificate is present but has uppercase letters" do
         before do
           @request = stub 'request', :key => "myhost"
         end
 
         # This is kind of more an integration test; it's for #1382, until
         # the support for upper-case certs can be removed around mid-2009.
         it "should rename the existing file to the lower-case path" do
           @path = @searcher.path("myhost")
           FileTest.expects(:exist?).with(@path).returns(false)
           dir, file = File.split(@path)
           FileTest.expects(:exist?).with(dir).returns true
           Dir.expects(:entries).with(dir).returns [".", "..", "something.pem", file.upcase]
 
           File.expects(:rename).with(File.join(dir, file.upcase), @path)
 
           cert = mock 'cert'
           model = mock 'model'
           @searcher.stubs(:model).returns model
           @searcher.model.expects(:new).with("myhost").returns cert
           cert.expects(:read).with(@path)
 
           @searcher.find(@request)
         end
       end
     end
 
     describe "when saving certificates to disk" do
       before do
         FileTest.stubs(:directory?).returns true
         FileTest.stubs(:writable?).returns true
       end
 
       it "should fail if the directory is absent" do
         FileTest.expects(:directory?).with(File.dirname(@certpath)).returns false
         lambda { @searcher.save(@request) }.should raise_error(Puppet::Error)
       end
 
       it "should fail if the directory is not writeable" do
         FileTest.stubs(:directory?).returns true
         FileTest.expects(:writable?).with(File.dirname(@certpath)).returns false
         lambda { @searcher.save(@request) }.should raise_error(Puppet::Error)
       end
 
       it "should save to the path the output of converting the certificate to a string" do
         fh = mock 'filehandle'
         fh.expects(:print).with("mycert")
 
         @searcher.stubs(:write).yields fh
         @cert.expects(:to_s).returns "mycert"
 
         @searcher.save(@request)
       end
 
       describe "and a directory setting is set" do
         it "should use the Settings class to write the file" do
           @searcher.class.store_in @setting
           fh = mock 'filehandle'
           fh.stubs :print
           Puppet.settings.expects(:writesub).with(@setting, @certpath).yields fh
 
           @searcher.save(@request)
         end
       end
 
       describe "and a file location is set" do
         it "should use the filehandle provided by the Settings" do
           @searcher.class.store_at @setting
 
           fh = mock 'filehandle'
           fh.stubs :print
           Puppet.settings.expects(:write).with(@setting).yields fh
           @searcher.save(@request)
         end
       end
 
       describe "and the name is the CA name and a ca setting is set" do
         it "should use the filehandle provided by the Settings" do
           @searcher.class.store_at @setting
           @searcher.class.store_ca_at :castuff
           Puppet.settings.stubs(:value).with(:castuff).returns "castuff stub"
 
           fh = mock 'filehandle'
           fh.stubs :print
           Puppet.settings.expects(:write).with(:castuff).yields fh
           @searcher.stubs(:ca?).returns true
           @searcher.save(@request)
         end
       end
     end
 
     describe "when destroying certificates" do
       describe "that do not exist" do
         before do
           FileTest.expects(:exist?).with(@certpath).returns false
         end
 
         it "should return false" do
           @searcher.destroy(@request).should be_false
         end
       end
 
       describe "that exist" do
         before do
           FileTest.expects(:exist?).with(@certpath).returns true
         end
 
         it "should unlink the certificate file" do
           File.expects(:unlink).with(@certpath)
           @searcher.destroy(@request)
         end
 
         it "should log that is removing the file" do
           File.stubs(:exist?).returns true
           File.stubs(:unlink)
           Puppet.expects(:notice)
           @searcher.destroy(@request)
         end
       end
     end
 
     describe "when searching for certificates" do
       before do
         @model = mock 'model'
         @file_class.stubs(:model).returns @model
       end
       it "should return a certificate instance for all files that exist" do
         Dir.expects(:entries).with(@path).returns %w{one.pem two.pem}
 
         one = stub 'one', :read => nil
         two = stub 'two', :read => nil
 
         @model.expects(:new).with("one").returns one
         @model.expects(:new).with("two").returns two
 
         @searcher.search(@request).should == [one, two]
       end
 
       it "should read each certificate in using the model's :read method" do
         Dir.expects(:entries).with(@path).returns %w{one.pem}
 
         one = stub 'one'
         one.expects(:read).with(File.join(@path, "one.pem"))
 
         @model.expects(:new).with("one").returns one
 
         @searcher.search(@request)
       end
 
       it "should skip any files that do not match /\.pem$/" do
         Dir.expects(:entries).with(@path).returns %w{. .. one.pem}
 
         one = stub 'one', :read => nil
 
         @model.expects(:new).with("one").returns one
 
         @searcher.search(@request)
       end
     end
   end
 end
diff --git a/spec/unit/indirector/yaml_spec.rb b/spec/unit/indirector/yaml_spec.rb
index 86c13c5a0..c8fadf72f 100755
--- a/spec/unit/indirector/yaml_spec.rb
+++ b/spec/unit/indirector/yaml_spec.rb
@@ -1,158 +1,172 @@
 #!/usr/bin/env ruby
 
 require File.dirname(__FILE__) + '/../../spec_helper'
 
 require 'puppet/indirector/yaml'
 
 describe Puppet::Indirector::Yaml, " when choosing file location" do
   before :each do
     @indirection = stub 'indirection', :name => :my_yaml, :register_terminus_type => nil
     Puppet::Indirector::Indirection.stubs(:instance).with(:my_yaml).returns(@indirection)
     @store_class = Class.new(Puppet::Indirector::Yaml) do
       def self.to_s
         "MyYaml::MyType"
       end
     end
     @store = @store_class.new
 
     @subject = Object.new
     @subject.singleton_class.send(:attr_accessor, :name)
     @subject.name = :me
 
     @dir = "/what/ever"
     Puppet.settings.stubs(:value).returns("fakesettingdata")
     Puppet.settings.stubs(:value).with(:clientyamldir).returns(@dir)
     Puppet.run_mode.stubs(:master?).returns false
 
     @request = stub 'request', :key => :me, :instance => @subject
   end
 
   describe Puppet::Indirector::Yaml, " when choosing file location" do
     it "should use the server_datadir if the run_mode is master" do
       Puppet.run_mode.expects(:master?).returns true
       Puppet.settings.expects(:value).with(:yamldir).returns "/server/yaml/dir"
       @store.path(:me).should =~ %r{^/server/yaml/dir}
     end
 
     it "should use the client yamldir if the run_mode is not master" do
       Puppet.run_mode.expects(:master?).returns false
       Puppet.settings.expects(:value).with(:clientyamldir).returns "/client/yaml/dir"
       @store.path(:me).should =~ %r{^/client/yaml/dir}
     end
 
     it "should use the extension if one is specified" do
       Puppet.run_mode.expects(:master?).returns true
       Puppet.settings.expects(:value).with(:yamldir).returns "/server/yaml/dir"
       @store.path(:me,'.farfignewton').should =~ %r{\.farfignewton$}
     end
 
     it "should assume an extension of .yaml if none is specified" do
       Puppet.run_mode.expects(:master?).returns true
       Puppet.settings.expects(:value).with(:yamldir).returns "/server/yaml/dir"
       @store.path(:me).should =~ %r{\.yaml$}
     end
 
     it "should store all files in a single file root set in the Puppet defaults" do
       @store.path(:me).should =~ %r{^#{@dir}}
     end
 
     it "should use the terminus name for choosing the subdirectory" do
       @store.path(:me).should =~ %r{^#{@dir}/my_yaml}
     end
 
     it "should use the object's name to determine the file name" do
       @store.path(:me).should =~ %r{me.yaml$}
     end
+
+    ['../foo', '..\\foo', './../foo', '.\\..\\foo',
+     '/foo', '//foo', '\\foo', '\\\\goo',
+     "test\0/../bar", "test\0\\..\\bar",
+     "..\\/bar", "/tmp/bar", "/tmp\\bar", "tmp\\bar",
+     " / bar", " /../ bar", " \\..\\ bar",
+     "c:\\foo", "c:/foo", "\\\\?\\UNC\\bar", "\\\\foo\\bar",
+     "\\\\?\\c:\\foo", "//?/UNC/bar", "//foo/bar",
+     "//?/c:/foo",
+    ].each do |input|
+      it "should resist directory traversal attacks (#{input.inspect})" do
+        expect { @store.path(input) }.to raise_error
+      end
+    end
   end
 
   describe Puppet::Indirector::Yaml, " when storing objects as YAML" do
     it "should only store objects that respond to :name" do
       @request.stubs(:instance).returns Object.new
       proc { @store.save(@request) }.should raise_error(ArgumentError)
     end
 
     it "should convert Ruby objects to YAML and write them to disk using a write lock" do
       yaml = @subject.to_yaml
       file = mock 'file'
       path = @store.send(:path, @subject.name)
       FileTest.expects(:exist?).with(File.dirname(path)).returns(true)
       @store.expects(:writelock).with(path, 0660).yields(file)
       file.expects(:print).with(yaml)
 
       @store.save(@request)
     end
 
     it "should create the indirection subdirectory if it does not exist" do
       yaml = @subject.to_yaml
       file = mock 'file'
       path = @store.send(:path, @subject.name)
       dir = File.dirname(path)
 
       FileTest.expects(:exist?).with(dir).returns(false)
       Dir.expects(:mkdir).with(dir)
 
       @store.expects(:writelock).yields(file)
       file.expects(:print).with(yaml)
 
       @store.save(@request)
     end
   end
 
   describe Puppet::Indirector::Yaml, " when retrieving YAML" do
     it "should read YAML in from disk using a read lock and convert it to Ruby objects" do
       path = @store.send(:path, @subject.name)
 
       yaml = @subject.to_yaml
       FileTest.expects(:exist?).with(path).returns(true)
 
       fh = mock 'filehandle'
       @store.expects(:readlock).with(path).yields fh
       fh.expects(:read).returns yaml
 
       @store.find(@request).instance_variable_get("@name").should == :me
     end
 
     it "should fail coherently when the stored YAML is invalid" do
       path = @store.send(:path, @subject.name)
       FileTest.expects(:exist?).with(path).returns(true)
 
       # Something that will fail in yaml
       yaml = "--- !ruby/object:Hash"
 
       fh = mock 'filehandle'
       @store.expects(:readlock).yields fh
       fh.expects(:read).returns yaml
 
       proc { @store.find(@request) }.should raise_error(Puppet::Error)
     end
   end
 
   describe Puppet::Indirector::Yaml, " when searching" do
     it "should return an array of fact instances with one instance for each file when globbing *" do
       @request = stub 'request', :key => "*", :instance => @subject
       @one = mock 'one'
       @two = mock 'two'
       @store.expects(:path).with(@request.key,'').returns :glob
       Dir.expects(:glob).with(:glob).returns(%w{one.yaml two.yaml})
       YAML.expects(:load_file).with("one.yaml").returns @one;
       YAML.expects(:load_file).with("two.yaml").returns @two;
       @store.search(@request).should == [@one, @two]
     end
 
     it "should return an array containing a single instance of fact when globbing 'one*'" do
       @request = stub 'request', :key => "one*", :instance => @subject
       @one = mock 'one'
       @store.expects(:path).with(@request.key,'').returns :glob
       Dir.expects(:glob).with(:glob).returns(%w{one.yaml})
       YAML.expects(:load_file).with("one.yaml").returns @one;
       @store.search(@request).should == [@one]
     end
 
     it "should return an empty array when the glob doesn't match anything" do
       @request = stub 'request', :key => "f*ilglobcanfail*", :instance => @subject
       @store.expects(:path).with(@request.key,'').returns :glob
       Dir.expects(:glob).with(:glob).returns []
       @store.search(@request).should == []
     end
   end
 end