- name: test CVE-2024-11079 loop variables preserve unsafe hostvars
  hosts: localhost
  gather_facts: false
  tasks:
  - set_fact:
      foo:
        safe:
          prop: '{{ "{{" }} unsafe_var {{ "}}" }}'
        unsafe:
          prop: !unsafe '{{ unsafe_var }}'

  - name: safe var through hostvars loop is templated
    assert:
      that:
      - item.prop == expected
    loop:
    - "{{ hostvars['localhost']['foo']['safe'] }}"
    vars:
      unsafe_var: bar
      expected: bar

  - name: unsafe var through hostvars loop is not templated
    assert:
      that:
      - item.prop == expected
    loop:
    - "{{ hostvars['localhost']['foo']['unsafe'] }}"
    vars:
      unsafe_var: bar
      expected: !unsafe '{{ unsafe_var }}'
