diff --git a/acceptance/tests/resource/exec/accept_multi-line_commands.rb b/acceptance/tests/resource/exec/accept_multi-line_commands.rb
new file mode 100644
index 000000000..1e9aaf15f
--- /dev/null
+++ b/acceptance/tests/resource/exec/accept_multi-line_commands.rb
@@ -0,0 +1,24 @@
+test_name "Be able to execute multi-line commands (#9996)"
+
+temp_file_name = "/tmp/9996-multi-line-commands.#{$$}"
+test_manifest = <<HERE
+exec { "test exec":
+      command =>  "/bin/echo '#Test' > #{temp_file_name};
+                   /bin/echo 'bob' >> #{temp_file_name};"
+}
+HERE
+
+expected_results = <<HERE
+#Test
+bob
+HERE
+
+on agents, "rm -f #{temp_file_name}"
+
+apply_manifest_on agents, test_manifest
+
+on(agents, "cat #{temp_file_name}").each do |result|
+  assert_equal(expected_results, "#{result.stdout}", "Unexpected result for host '#{result.host}'")
+end
+
+on agents, "rm -f #{temp_file_name}"
diff --git a/lib/puppet/util.rb b/lib/puppet/util.rb
index b115a160d..0875e0879 100644
--- a/lib/puppet/util.rb
+++ b/lib/puppet/util.rb
@@ -1,499 +1,504 @@
 # A module to collect utility functions.
 
 require 'English'
 require 'puppet/util/monkey_patches'
 require 'sync'
 require 'tempfile'
 require 'puppet/external/lock'
 require 'monitor'
 require 'puppet/util/execution_stub'
 require 'uri'
 
 module Puppet
   # A command failed to execute.
   require 'puppet/error'
   class ExecutionFailure < Puppet::Error
   end
 module Util
   require 'benchmark'
 
   # These are all for backward compatibility -- these are methods that used
   # to be in Puppet::Util but have been moved into external modules.
   require 'puppet/util/posix'
   extend Puppet::Util::POSIX
 
   @@sync_objects = {}.extend MonitorMixin
 
   def self.activerecord_version
     if (defined?(::ActiveRecord) and defined?(::ActiveRecord::VERSION) and defined?(::ActiveRecord::VERSION::MAJOR) and defined?(::ActiveRecord::VERSION::MINOR))
       ([::ActiveRecord::VERSION::MAJOR, ::ActiveRecord::VERSION::MINOR].join('.').to_f)
     else
       0
     end
   end
 
   def self.synchronize_on(x,type)
     sync_object,users = 0,1
     begin
       @@sync_objects.synchronize {
         (@@sync_objects[x] ||= [Sync.new,0])[users] += 1
       }
       @@sync_objects[x][sync_object].synchronize(type) { yield }
     ensure
       @@sync_objects.synchronize {
         @@sync_objects.delete(x) unless (@@sync_objects[x][users] -= 1) > 0
       }
     end
   end
 
   # Change the process to a different user
   def self.chuser
     if group = Puppet[:group]
       begin
         Puppet::Util::SUIDManager.change_group(group, true)
       rescue => detail
         Puppet.warning "could not change to group #{group.inspect}: #{detail}"
         $stderr.puts "could not change to group #{group.inspect}"
 
         # Don't exit on failed group changes, since it's
         # not fatal
         #exit(74)
       end
     end
 
     if user = Puppet[:user]
       begin
         Puppet::Util::SUIDManager.change_user(user, true)
       rescue => detail
         $stderr.puts "Could not change to user #{user}: #{detail}"
         exit(74)
       end
     end
   end
 
   # Create instance methods for each of the log levels.  This allows
   # the messages to be a little richer.  Most classes will be calling this
   # method.
   def self.logmethods(klass, useself = true)
     Puppet::Util::Log.eachlevel { |level|
       klass.send(:define_method, level, proc { |args|
         args = args.join(" ") if args.is_a?(Array)
         if useself
 
           Puppet::Util::Log.create(
             :level => level,
             :source => self,
             :message => args
           )
         else
 
           Puppet::Util::Log.create(
             :level => level,
             :message => args
           )
         end
       })
     }
   end
 
   # Proxy a bunch of methods to another object.
   def self.classproxy(klass, objmethod, *methods)
     classobj = class << klass; self; end
     methods.each do |method|
       classobj.send(:define_method, method) do |*args|
         obj = self.send(objmethod)
 
         obj.send(method, *args)
       end
     end
   end
 
   # Proxy a bunch of methods to another object.
   def self.proxy(klass, objmethod, *methods)
     methods.each do |method|
       klass.send(:define_method, method) do |*args|
         obj = self.send(objmethod)
 
         obj.send(method, *args)
       end
     end
   end
 
   # XXX this should all be done using puppet objects, not using
   # normal mkdir
   def self.recmkdir(dir,mode = 0755)
     if FileTest.exist?(dir)
       return false
     else
       tmp = dir.sub(/^\//,'')
       path = [File::SEPARATOR]
       tmp.split(File::SEPARATOR).each { |dir|
         path.push dir
         if ! FileTest.exist?(File.join(path))
           Dir.mkdir(File.join(path), mode)
         elsif FileTest.directory?(File.join(path))
           next
         else FileTest.exist?(File.join(path))
           raise "Cannot create #{dir}: basedir #{File.join(path)} is a file"
         end
       }
       return true
     end
   end
 
   # Execute a given chunk of code with a new umask.
   def self.withumask(mask)
     cur = File.umask(mask)
 
     begin
       yield
     ensure
       File.umask(cur)
     end
   end
 
   def benchmark(*args)
     msg = args.pop
     level = args.pop
     object = nil
 
     if args.empty?
       if respond_to?(level)
         object = self
       else
         object = Puppet
       end
     else
       object = args.pop
     end
 
     raise Puppet::DevError, "Failed to provide level to :benchmark" unless level
 
     unless level == :none or object.respond_to? level
       raise Puppet::DevError, "Benchmarked object does not respond to #{level}"
     end
 
     # Only benchmark if our log level is high enough
     if level != :none and Puppet::Util::Log.sendlevel?(level)
       result = nil
       seconds = Benchmark.realtime {
         yield
       }
       object.send(level, msg + (" in %0.2f seconds" % seconds))
       return seconds
     else
       yield
     end
   end
 
   def which(bin)
     if absolute_path?(bin)
       return bin if FileTest.file? bin and FileTest.executable? bin
     else
       ENV['PATH'].split(File::PATH_SEPARATOR).each do |dir|
         dest=File.join(dir, bin)
         return dest if FileTest.file? dest and FileTest.executable? dest
       end
     end
     nil
   end
   module_function :which
 
   # Determine in a platform-specific way whether a path is absolute. This
   # defaults to the local platform if none is specified.
   def absolute_path?(path, platform=nil)
     # Escape once for the string literal, and once for the regex.
     slash = '[\\\\/]'
     name = '[^\\\\/]+'
     regexes = {
       :windows => %r!^(([A-Z]:#{slash})|(#{slash}#{slash}#{name}#{slash}#{name})|(#{slash}#{slash}\?#{slash}#{name}))!i,
       :posix   => %r!^/!,
     }
     require 'puppet'
     platform ||= Puppet.features.microsoft_windows? ? :windows : :posix
 
     !! (path =~ regexes[platform])
   end
   module_function :absolute_path?
 
   # Convert a path to a file URI
   def path_to_uri(path)
     return unless path
 
     params = { :scheme => 'file' }
 
     if Puppet.features.microsoft_windows?
       path = path.gsub(/\\/, '/')
 
       if unc = /^\/\/([^\/]+)(\/[^\/]+)/.match(path)
         params[:host] = unc[1]
         path = unc[2]
       elsif path =~ /^[a-z]:\//i
         path = '/' + path
       end
     end
 
     params[:path] = URI.escape(path)
 
     begin
       URI::Generic.build(params)
     rescue => detail
       raise Puppet::Error, "Failed to convert '#{path}' to URI: #{detail}"
     end
   end
   module_function :path_to_uri
 
   # Get the path component of a URI
   def uri_to_path(uri)
     return unless uri.is_a?(URI)
 
     path = URI.unescape(uri.path)
 
     if Puppet.features.microsoft_windows? and uri.scheme == 'file'
       if uri.host
         path = "//#{uri.host}" + path # UNC
       else
         path.sub!(/^\//, '')
       end
     end
 
     path
   end
   module_function :uri_to_path
 
   # Execute the provided command in a pipe, yielding the pipe object.
   def execpipe(command, failonfail = true)
     if respond_to? :debug
       debug "Executing '#{command}'"
     else
       Puppet.debug "Executing '#{command}'"
     end
 
     command_str = command.respond_to?(:join) ? command.join('') : command
     output = open("| #{command_str} 2>&1") do |pipe|
       yield pipe
     end
 
     if failonfail
       unless $CHILD_STATUS == 0
         raise ExecutionFailure, output
       end
     end
 
     output
   end
 
   def execfail(command, exception)
       output = execute(command)
       return output
   rescue ExecutionFailure
       raise exception, output
   end
 
   def execute_posix(command, arguments, stdin, stdout, stderr)
     child_pid = Kernel.fork do
-      command = Array(command)
+      # We can't just call Array(command), and rely on it returning
+      # things like ['foo'], when passed ['foo'], because
+      # Array(command) will call command.to_a internally, which when
+      # given a string can end up doing Very Bad Things(TM), such as
+      # turning "/tmp/foo;\r\n /bin/echo" into ["/tmp/foo;\r\n", " /bin/echo"]
+      command = [command].flatten
       Process.setsid
       begin
         $stdin.reopen(stdin)
         $stdout.reopen(stdout)
         $stderr.reopen(stderr)
 
         3.upto(256){|fd| IO::new(fd).close rescue nil}
 
         Puppet::Util::SUIDManager.change_group(arguments[:gid], true) if arguments[:gid]
         Puppet::Util::SUIDManager.change_user(arguments[:uid], true)  if arguments[:uid]
 
         ENV['LANG'] = ENV['LC_ALL'] = ENV['LC_MESSAGES'] = ENV['LANGUAGE'] = 'C'
         Kernel.exec(*command)
       rescue => detail
         puts detail.to_s
         exit!(1)
       end
     end
     child_pid
   end
   module_function :execute_posix
 
   def execute_windows(command, arguments, stdin, stdout, stderr)
     command = command.map do |part|
       part.include?(' ') ? %Q["#{part.gsub(/"/, '\"')}"] : part
     end.join(" ") if command.is_a?(Array)
 
     process_info = Process.create( :command_line => command, :startup_info => {:stdin => stdin, :stdout => stdout, :stderr => stderr} )
     process_info.process_id
   end
   module_function :execute_windows
 
   # Execute the desired command, and return the status and output.
   # def execute(command, failonfail = true, uid = nil, gid = nil)
   # :combine sets whether or not to combine stdout/stderr in the output
   # :stdinfile sets a file that can be used for stdin. Passing a string
   # for stdin is not currently supported.
   def execute(command, arguments = {:failonfail => true, :combine => true})
     if command.is_a?(Array)
       command = command.flatten.map(&:to_s)
       str = command.join(" ")
     elsif command.is_a?(String)
       str = command
     end
 
     if respond_to? :debug
       debug "Executing '#{str}'"
     else
       Puppet.debug "Executing '#{str}'"
     end
 
     null_file = Puppet.features.microsoft_windows? ? 'NUL' : '/dev/null'
 
     stdin = File.open(arguments[:stdinfile] || null_file, 'r')
     stdout = arguments[:squelch] ? File.open(null_file, 'w') : Tempfile.new('puppet')
     stderr = arguments[:combine] ? stdout : File.open(null_file, 'w')
 
 
     exec_args = [command, arguments, stdin, stdout, stderr]
 
     if execution_stub = Puppet::Util::ExecutionStub.current_value
       return execution_stub.call(*exec_args)
     elsif Puppet.features.posix?
       child_pid = execute_posix(*exec_args)
       child_status = Process.waitpid2(child_pid).last.exitstatus
     elsif Puppet.features.microsoft_windows?
       child_pid = execute_windows(*exec_args)
       child_status = Process.waitpid2(child_pid).last
     end
 
     [stdin, stdout, stderr].each {|io| io.close rescue nil}
 
     # read output in if required
     unless arguments[:squelch]
       output = wait_for_output(stdout)
       Puppet.warning "Could not get output" unless output
     end
 
     if arguments[:failonfail] and child_status != 0
       raise ExecutionFailure, "Execution of '#{str}' returned #{child_status}: #{output}"
     end
 
     output
   end
 
   module_function :execute
 
   def wait_for_output(stdout)
     # Make sure the file's actually been written.  This is basically a race
     # condition, and is probably a horrible way to handle it, but, well, oh
     # well.
     2.times do |try|
       if File.exists?(stdout.path)
         output = stdout.open.read
 
         stdout.close(true)
 
         return output
       else
         time_to_sleep = try / 2.0
         Puppet.warning "Waiting for output; will sleep #{time_to_sleep} seconds"
         sleep(time_to_sleep)
       end
     end
     nil
   end
   module_function :wait_for_output
 
   # Create an exclusive lock.
   def threadlock(resource, type = Sync::EX)
     Puppet::Util.synchronize_on(resource,type) { yield }
   end
 
   # Because some modules provide their own version of this method.
   alias util_execute execute
 
   module_function :benchmark
 
   def memory
     unless defined?(@pmap)
       @pmap = which('pmap')
     end
     if @pmap
       %x{#{@pmap} #{Process.pid}| grep total}.chomp.sub(/^\s*total\s+/, '').sub(/K$/, '').to_i
     else
       0
     end
   end
 
   def symbolize(value)
     if value.respond_to? :intern
       value.intern
     else
       value
     end
   end
 
   def symbolizehash(hash)
     newhash = {}
     hash.each do |name, val|
       if name.is_a? String
         newhash[name.intern] = val
       else
         newhash[name] = val
       end
     end
   end
 
   def symbolizehash!(hash)
     hash.each do |name, val|
       if name.is_a? String
         hash[name.intern] = val
         hash.delete(name)
       end
     end
 
     hash
   end
   module_function :symbolize, :symbolizehash, :symbolizehash!
 
   # Just benchmark, with no logging.
   def thinmark
     seconds = Benchmark.realtime {
       yield
     }
 
     seconds
   end
 
   module_function :memory, :thinmark
 
   def secure_open(file,must_be_w,&block)
     raise Puppet::DevError,"secure_open only works with mode 'w'" unless must_be_w == 'w'
     raise Puppet::DevError,"secure_open only requires a block"    unless block_given?
     Puppet.warning "#{file} was a symlink to #{File.readlink(file)}" if File.symlink?(file)
     if File.exists?(file) or File.symlink?(file)
       wait = File.symlink?(file) ? 5.0 : 0.1
       File.delete(file)
       sleep wait # give it a chance to reappear, just in case someone is actively trying something.
     end
     begin
       File.open(file,File::CREAT|File::EXCL|File::TRUNC|File::WRONLY,&block)
     rescue Errno::EEXIST
       desc = File.symlink?(file) ? "symlink to #{File.readlink(file)}" : File.stat(file).ftype
       puts "Warning: #{file} was apparently created by another process (as"
       puts "a #{desc}) as soon as it was deleted by this process.  Someone may be trying"
       puts "to do something objectionable (such as tricking you into overwriting system"
       puts "files if you are running as root)."
       raise
     end
   end
   module_function :secure_open
 end
 end
 
 require 'puppet/util/errors'
 require 'puppet/util/methodhelper'
 require 'puppet/util/metaid'
 require 'puppet/util/classgen'
 require 'puppet/util/docs'
 require 'puppet/util/execution'
 require 'puppet/util/logging'
 require 'puppet/util/package'
 require 'puppet/util/warnings'
diff --git a/lib/puppet/util/suidmanager.rb b/lib/puppet/util/suidmanager.rb
index 56f841a38..d733883b4 100644
--- a/lib/puppet/util/suidmanager.rb
+++ b/lib/puppet/util/suidmanager.rb
@@ -1,153 +1,152 @@
 require 'puppet/util/warnings'
 require 'forwardable'
 
 module Puppet::Util::SUIDManager
   include Puppet::Util::Warnings
   extend Forwardable
 
   # Note groups= is handled specially due to a bug in OS X 10.6
   to_delegate_to_process = [ :euid=, :euid, :egid=, :egid, :uid=, :uid, :gid=, :gid, :groups ]
 
   to_delegate_to_process.each do |method|
     def_delegator Process, method
     module_function method
   end
 
   def osx_maj_ver
     return @osx_maj_ver unless @osx_maj_ver.nil?
     require 'facter'
     # 'kernel' is available without explicitly loading all facts
     if Facter.value('kernel') != 'Darwin'
       @osx_maj_ver = false
       return @osx_maj_ver
     end
     # But 'macosx_productversion_major' requires it.
     Facter.loadfacts
     @osx_maj_ver = Facter.value('macosx_productversion_major')
   end
   module_function :osx_maj_ver
 
   def groups=(grouplist)
     if osx_maj_ver == '10.6'
       return true
     else
       return Process.groups = grouplist
     end
   end
   module_function :groups=
 
   def self.root?
     return Process.uid == 0 unless Puppet.features.microsoft_windows?
 
     require 'sys/admin'
     require 'win32/security'
     require 'facter'
 
     majversion = Facter.value(:kernelmajversion)
     return false unless majversion
 
     # if Vista or later, check for unrestricted process token
     return Win32::Security.elevated_security? unless majversion.to_f < 6.0
 
     group = Sys::Admin.get_group("Administrators", :sid => Win32::Security::SID::BuiltinAdministrators)
     group and group.members.index(Sys::Admin.get_login) != nil
   end
 
   # Runs block setting uid and gid if provided then restoring original ids
   def asuser(new_uid=nil, new_gid=nil)
     return yield if Puppet.features.microsoft_windows? or !root?
 
     old_euid, old_egid = self.euid, self.egid
     begin
       change_group(new_gid) if new_gid
       change_user(new_uid) if new_uid
 
       yield
     ensure
       change_group(old_egid)
       change_user(old_euid)
     end
   end
   module_function :asuser
 
   def change_group(group, permanently=false)
     gid = convert_xid(:gid, group)
     raise Puppet::Error, "No such group #{group}" unless gid
 
     if permanently
       begin
         Process::GID.change_privilege(gid)
       rescue NotImplementedError
         Process.egid = gid
         Process.gid  = gid
       end
     else
       Process.egid = gid
     end
   end
   module_function :change_group
 
   def change_user(user, permanently=false)
     uid = convert_xid(:uid, user)
     raise Puppet::Error, "No such user #{user}" unless uid
 
     if permanently
       begin
         Process::UID.change_privilege(uid)
       rescue NotImplementedError
         # If changing uid, we must be root. So initgroups first here.
         initgroups(uid)
         Process.euid = uid
         Process.uid  = uid
       end
     else
       # If we're already root, initgroups before changing euid. If we're not,
       # change euid (to root) first.
       if Process.euid == 0
         initgroups(uid)
         Process.euid = uid
       else
         Process.euid = uid
         initgroups(uid)
       end
     end
   end
   module_function :change_user
 
   # Make sure the passed argument is a number.
   def convert_xid(type, id)
     map = {:gid => :group, :uid => :user}
     raise ArgumentError, "Invalid id type #{type}" unless map.include?(type)
     ret = Puppet::Util.send(type, id)
     if ret == nil
       raise Puppet::Error, "Invalid #{map[type]}: #{id}"
     end
     ret
   end
   module_function :convert_xid
 
   # Initialize supplementary groups
   def initgroups(user)
     require 'etc'
     Process.initgroups(Etc.getpwuid(user).name, Process.gid)
   end
 
   module_function :initgroups
 
   def run_and_capture(command, new_uid=nil, new_gid=nil)
     output = Puppet::Util.execute(command, :failonfail => false, :combine => true, :uid => new_uid, :gid => new_gid)
     [output, $CHILD_STATUS.dup]
   end
   module_function :run_and_capture
 
   def system(command, new_uid=nil, new_gid=nil)
     status = nil
     asuser(new_uid, new_gid) do
       Kernel.system(command)
       status = $CHILD_STATUS.dup
     end
     status
   end
   module_function :system
 end
-
diff --git a/spec/unit/util_spec.rb b/spec/unit/util_spec.rb
index 5bfb2f7bf..8fe0ae743 100755
--- a/spec/unit/util_spec.rb
+++ b/spec/unit/util_spec.rb
@@ -1,442 +1,448 @@
 #!/usr/bin/env ruby
 
 require 'spec_helper'
 
 describe Puppet::Util do
   def process_status(exitstatus)
     return exitstatus if Puppet.features.microsoft_windows?
 
     stub('child_status', :exitstatus => exitstatus)
   end
 
   describe "#absolute_path?" do
     it "should default to the platform of the local system" do
       Puppet.features.stubs(:posix?).returns(true)
       Puppet.features.stubs(:microsoft_windows?).returns(false)
 
       Puppet::Util.should be_absolute_path('/foo')
       Puppet::Util.should_not be_absolute_path('C:/foo')
 
       Puppet.features.stubs(:posix?).returns(false)
       Puppet.features.stubs(:microsoft_windows?).returns(true)
 
       Puppet::Util.should be_absolute_path('C:/foo')
       Puppet::Util.should_not be_absolute_path('/foo')
     end
 
     describe "when using platform :posix" do
       %w[/ /foo /foo/../bar //foo //Server/Foo/Bar //?/C:/foo/bar /\Server/Foo /foo//bar/baz].each do |path|
         it "should return true for #{path}" do
           Puppet::Util.should be_absolute_path(path, :posix)
         end
       end
 
       %w[. ./foo \foo C:/foo \\Server\Foo\Bar \\?\C:\foo\bar \/?/foo\bar \/Server/foo foo//bar/baz].each do |path|
         it "should return false for #{path}" do
           Puppet::Util.should_not be_absolute_path(path, :posix)
         end
       end
     end
 
     describe "when using platform :windows" do
       %w[C:/foo C:\foo \\\\Server\Foo\Bar \\\\?\C:\foo\bar //Server/Foo/Bar //?/C:/foo/bar /\?\C:/foo\bar \/Server\Foo/Bar c:/foo//bar//baz].each do |path|
         it "should return true for #{path}" do
           Puppet::Util.should be_absolute_path(path, :windows)
         end
       end
 
       %w[/ . ./foo \foo /foo /foo/../bar //foo C:foo/bar foo//bar/baz].each do |path|
         it "should return false for #{path}" do
           Puppet::Util.should_not be_absolute_path(path, :windows)
         end
       end
     end
   end
 
   describe "#path_to_uri" do
     %w[. .. foo foo/bar foo/../bar].each do |path|
       it "should reject relative path: #{path}" do
         lambda { Puppet::Util.path_to_uri(path) }.should raise_error(Puppet::Error)
       end
     end
 
     it "should perform URI escaping" do
       Puppet::Util.path_to_uri("/foo bar").path.should == "/foo%20bar"
     end
 
     describe "when using platform :posix" do
       before :each do
         Puppet.features.stubs(:posix).returns true
         Puppet.features.stubs(:microsoft_windows?).returns false
       end
 
       %w[/ /foo /foo/../bar].each do |path|
         it "should convert #{path} to URI" do
           Puppet::Util.path_to_uri(path).path.should == path
         end
       end
     end
 
     describe "when using platform :windows" do
       before :each do
         Puppet.features.stubs(:posix).returns false
         Puppet.features.stubs(:microsoft_windows?).returns true
       end
 
       it "should normalize backslashes" do
         Puppet::Util.path_to_uri('c:\\foo\\bar\\baz').path.should == '/' + 'c:/foo/bar/baz'
       end
 
       %w[C:/ C:/foo/bar].each do |path|
         it "should convert #{path} to absolute URI" do
           Puppet::Util.path_to_uri(path).path.should == '/' + path
         end
       end
 
       %w[share C$].each do |path|
         it "should convert UNC #{path} to absolute URI" do
           uri = Puppet::Util.path_to_uri("\\\\server\\#{path}")
           uri.host.should == 'server'
           uri.path.should == '/' + path
         end
       end
     end
   end
 
   describe ".uri_to_path" do
     require 'uri'
 
     it "should strip host component" do
       Puppet::Util.uri_to_path(URI.parse('http://foo/bar')).should == '/bar'
     end
 
     it "should accept puppet URLs" do
       Puppet::Util.uri_to_path(URI.parse('puppet:///modules/foo')).should == '/modules/foo'
     end
 
     it "should return unencoded path" do
       Puppet::Util.uri_to_path(URI.parse('http://foo/bar%20baz')).should == '/bar baz'
     end
 
     it "should be nil-safe" do
       Puppet::Util.uri_to_path(nil).should be_nil
     end
 
     describe "when using platform :posix",:if => Puppet.features.posix? do
       it "should accept root" do
         Puppet::Util.uri_to_path(URI.parse('file:/')).should == '/'
       end
 
       it "should accept single slash" do
         Puppet::Util.uri_to_path(URI.parse('file:/foo/bar')).should == '/foo/bar'
       end
 
       it "should accept triple slashes" do
         Puppet::Util.uri_to_path(URI.parse('file:///foo/bar')).should == '/foo/bar'
       end
     end
 
     describe "when using platform :windows", :if => Puppet.features.microsoft_windows? do
       it "should accept root" do
         Puppet::Util.uri_to_path(URI.parse('file:/C:/')).should == 'C:/'
       end
 
       it "should accept single slash" do
         Puppet::Util.uri_to_path(URI.parse('file:/C:/foo/bar')).should == 'C:/foo/bar'
       end
 
       it "should accept triple slashes" do
         Puppet::Util.uri_to_path(URI.parse('file:///C:/foo/bar')).should == 'C:/foo/bar'
       end
 
       it "should accept file scheme with double slashes as a UNC path" do
         Puppet::Util.uri_to_path(URI.parse('file://host/share/file')).should == '//host/share/file'
       end
     end
   end
 
   describe "execution methods" do
     let(:pid) { 5501 }
     let(:null_file) { Puppet.features.microsoft_windows? ? 'NUL' : '/dev/null' }
 
     describe "#execute_posix" do
       before :each do
         # Most of the things this method does are bad to do during specs. :/
         Kernel.stubs(:fork).returns(pid).yields
         Process.stubs(:setsid)
         Kernel.stubs(:exec)
         Puppet::Util::SUIDManager.stubs(:change_user)
         Puppet::Util::SUIDManager.stubs(:change_group)
 
         $stdin.stubs(:reopen)
         $stdout.stubs(:reopen)
         $stderr.stubs(:reopen)
 
         @stdin  = File.open(null_file, 'r')
         @stdout = Tempfile.new('stdout')
         @stderr = File.open(null_file, 'w')
       end
 
       it "should fork a child process to execute the command" do
         Kernel.expects(:fork).returns(pid).yields
         Kernel.expects(:exec).with('test command')
 
         Puppet::Util.execute_posix('test command', {}, @stdin, @stdout, @stderr)
       end
 
       it "should start a new session group" do
         Process.expects(:setsid)
 
         Puppet::Util.execute_posix('test command', {}, @stdin, @stdout, @stderr)
       end
 
       it "should close all open file descriptors except stdin/stdout/stderr" do
         # This is ugly, but I can't really think of a better way to do it without
         # letting it actually close fds, which seems risky
         (0..2).each {|n| IO.expects(:new).with(n).never}
         (3..256).each {|n| IO.expects(:new).with(n).returns mock('io', :close) }
 
         Puppet::Util.execute_posix('test command', {}, @stdin, @stdout, @stderr)
       end
 
       it "should permanently change to the correct user and group if specified" do
         Puppet::Util::SUIDManager.expects(:change_group).with(55, true)
         Puppet::Util::SUIDManager.expects(:change_user).with(50, true)
 
         Puppet::Util.execute_posix('test command', {:uid => 50, :gid => 55}, @stdin, @stdout, @stderr)
       end
 
       it "should exit failure if there is a problem execing the command" do
         Kernel.expects(:exec).with('test command').raises("failed to execute!")
         Puppet::Util.stubs(:puts)
         Puppet::Util.expects(:exit!).with(1)
 
         Puppet::Util.execute_posix('test command', {}, @stdin, @stdout, @stderr)
       end
 
       it "should properly execute commands specified as arrays" do
         Kernel.expects(:exec).with('test command', 'with', 'arguments')
 
         Puppet::Util.execute_posix(['test command', 'with', 'arguments'], {:uid => 50, :gid => 55}, @stdin, @stdout, @stderr)
       end
 
+      it "should properly execute string commands with embedded newlines" do
+        Kernel.expects(:exec).with("/bin/echo 'foo' ; \n /bin/echo 'bar' ;")
+
+        Puppet::Util.execute_posix("/bin/echo 'foo' ; \n /bin/echo 'bar' ;", {:uid => 50, :gid => 55}, @stdin, @stdout, @stderr)
+      end
+
       it "should return the pid of the child process" do
         Puppet::Util.execute_posix('test command', {}, @stdin, @stdout, @stderr).should == pid
       end
     end
 
     describe "#execute_windows" do
       let(:proc_info_stub) { stub 'processinfo', :process_id => pid }
 
       before :each do
         Process.stubs(:create).returns(proc_info_stub)
         Process.stubs(:waitpid2).with(pid).returns([pid, process_status(0)])
 
         @stdin  = File.open(null_file, 'r')
         @stdout = Tempfile.new('stdout')
         @stderr = File.open(null_file, 'w')
       end
 
       it "should create a new process for the command" do
         Process.expects(:create).with(
           :command_line => "test command",
           :startup_info => {:stdin => @stdin, :stdout => @stdout, :stderr => @stderr}
         ).returns(proc_info_stub)
 
         Puppet::Util.execute_windows('test command', {}, @stdin, @stdout, @stderr)
       end
 
       it "should return the pid of the child process" do
         Puppet::Util.execute_windows('test command', {}, @stdin, @stdout, @stderr).should == pid
       end
 
       it "should quote arguments containing spaces if command is specified as an array" do
         Process.expects(:create).with do |args|
           args[:command_line] == '"test command" with some "arguments \"with spaces"'
         end.returns(proc_info_stub)
 
         Puppet::Util.execute_windows(['test command', 'with', 'some', 'arguments "with spaces'], {}, @stdin, @stdout, @stderr)
       end
     end
 
     describe "#execute" do
       before :each do
         Process.stubs(:waitpid2).with(pid).returns([pid, process_status(0)])
       end
 
       describe "when an execution stub is specified" do
         before :each do
           Puppet::Util::ExecutionStub.set do |command,args,stdin,stdout,stderr|
             "execution stub output"
           end
         end
 
         it "should call the block on the stub" do
           Puppet::Util.execute("/usr/bin/run_my_execute_stub").should == "execution stub output"
         end
 
         it "should not actually execute anything" do
           Puppet::Util.expects(:execute_posix).never
           Puppet::Util.expects(:execute_windows).never
 
           Puppet::Util.execute("/usr/bin/run_my_execute_stub")
         end
       end
 
       describe "when setting up input and output files" do
         include PuppetSpec::Files
         let(:executor) { Puppet.features.microsoft_windows? ? 'execute_windows' : 'execute_posix' }
 
         before :each do
           Puppet::Util.stubs(:wait_for_output)
         end
 
         it "should set stdin to the stdinfile if specified" do
           input = tmpfile('stdin')
           FileUtils.touch(input)
 
           Puppet::Util.expects(executor).with do |_,_,stdin,_,_|
             stdin.path == input
           end.returns(pid)
 
           Puppet::Util.execute('test command', :stdinfile => input)
         end
 
         it "should set stdin to the null file if not specified" do
           Puppet::Util.expects(executor).with do |_,_,stdin,_,_|
             stdin.path == null_file
           end.returns(pid)
 
           Puppet::Util.execute('test command')
         end
 
         describe "when squelch is set" do
           it "should set stdout and stderr to the null file" do
             Puppet::Util.expects(executor).with do |_,_,_,stdout,stderr|
               stdout.path == null_file and stderr.path == null_file
             end.returns(pid)
 
             Puppet::Util.execute('test command', :squelch => true)
           end
         end
 
         describe "when squelch is not set" do
           it "should set stdout to a temporary output file" do
             outfile = Tempfile.new('stdout')
             Tempfile.stubs(:new).returns(outfile)
 
             Puppet::Util.expects(executor).with do |_,_,_,stdout,_|
               stdout.path == outfile.path
             end.returns(pid)
 
             Puppet::Util.execute('test command', :squelch => false)
           end
 
           it "should set stderr to the same file as stdout if combine is true" do
             outfile = Tempfile.new('stdout')
             Tempfile.stubs(:new).returns(outfile)
 
             Puppet::Util.expects(executor).with do |_,_,_,stdout,stderr|
               stdout.path == outfile.path and stderr.path == outfile.path
             end.returns(pid)
 
             Puppet::Util.execute('test command', :squelch => false, :combine => true)
           end
 
           it "should set stderr to the null device if combine is false" do
             outfile = Tempfile.new('stdout')
             Tempfile.stubs(:new).returns(outfile)
 
             Puppet::Util.expects(executor).with do |_,_,_,stdout,stderr|
               stdout.path == outfile.path and stderr.path == null_file
             end.returns(pid)
 
             Puppet::Util.execute('test command', :squelch => false, :combine => false)
           end
         end
       end
     end
 
     describe "after execution" do
       let(:executor) { Puppet.features.microsoft_windows? ? 'execute_windows' : 'execute_posix' }
 
       before :each do
         Process.stubs(:waitpid2).with(pid).returns([pid, process_status(0)])
 
         Puppet::Util.stubs(executor).returns(pid)
       end
 
       it "should wait for the child process to exit" do
         Puppet::Util.stubs(:wait_for_output)
 
         Process.expects(:waitpid2).with(pid).returns([pid, process_status(0)])
 
         Puppet::Util.execute('test command')
       end
 
       it "should close the stdin/stdout/stderr files used by the child" do
         stdin = mock 'file', :close
         stdout = mock 'file', :close
         stderr = mock 'file', :close
 
         File.expects(:open).
           times(3).
           returns(stdin).
           then.returns(stdout).
           then.returns(stderr)
 
         Puppet::Util.execute('test command', :squelch => true)
       end
 
       it "should read and return the output if squelch is false" do
         stdout = Tempfile.new('test')
         Tempfile.stubs(:new).returns(stdout)
         stdout.write("My expected command output")
 
         Puppet::Util.execute('test command').should == "My expected command output"
       end
 
       it "should not read the output if squelch is true" do
         stdout = Tempfile.new('test')
         Tempfile.stubs(:new).returns(stdout)
         stdout.write("My expected command output")
 
         Puppet::Util.execute('test command', :squelch => true).should == nil
       end
 
       it "should delete the file used for output if squelch is false" do
         stdout = Tempfile.new('test')
         path = stdout.path
         Tempfile.stubs(:new).returns(stdout)
 
         Puppet::Util.execute('test command')
 
         File.should_not be_exist(path)
       end
 
       it "should raise an error if failonfail is true and the child failed" do
         Process.expects(:waitpid2).with(pid).returns([pid, process_status(1)])
 
         expect {
           Puppet::Util.execute('fail command', :failonfail => true)
         }.to raise_error(Puppet::ExecutionFailure, /Execution of 'fail command' returned 1/)
       end
 
       it "should not raise an error if failonfail is false and the child failed" do
         Process.expects(:waitpid2).with(pid).returns([pid, process_status(1)])
 
         expect {
           Puppet::Util.execute('fail command', :failonfail => false)
         }.not_to raise_error
       end
 
       it "should not raise an error if failonfail is true and the child succeeded" do
         Process.expects(:waitpid2).with(pid).returns([pid, process_status(0)])
 
         expect {
           Puppet::Util.execute('fail command', :failonfail => true)
         }.not_to raise_error
       end
     end
   end
 end