Handle complex quoting in extra args in pull cli (#50212)

* Handle complex quoting in extra args in pull cli

fixes #40729

changelogs/fragments/fix_pull_extra.yml

@@ -0,0 +1,2 @@
+bugfixes:
+    - fix ansible-pull hanlding of extra args, complex quoting is needed for inline JSON

lib/ansible/cli/pull.py

@@ -20,6 +20,7 @@ from ansible.cli import CLI
 from ansible.cli.arguments import optparse_helpers as opt_help
 from ansible.errors import AnsibleOptionsError
 from ansible.module_utils._text import to_native, to_text
+from ansible.module_utils.six.moves import shlex_quote
 from ansible.plugins.loader import module_loader
 from ansible.utils.cmd_functions import run_cmd
 from ansible.utils.display import Display
@@ -222,9 +223,8 @@ class PullCLI(CLI):
         cmd = '%s/ansible %s %s -m %s -a "%s" all -l "%s"' % (bin_path, inv_opts, base_opts,
                                                               context.CLIARGS['module_name'],
                                                               repo_opts, limit_opts)
-
         for ev in context.CLIARGS['extra_vars']:
-            cmd += ' -e "%s"' % ev
+            cmd += ' -e "%s"' % shlex_quote(ev)
 
         # Nap?
         if context.CLIARGS['sleep']:
@@ -259,7 +259,7 @@ class PullCLI(CLI):
                 cmd += " --vault-id=%s" % vault_id
 
         for ev in context.CLIARGS['extra_vars']:
-            cmd += ' -e "%s"' % ev
+            cmd += ' -e "%s"' % shlex_quote(ev)
         if context.CLIARGS['ask_sudo_pass'] or context.CLIARGS['ask_su_pass'] or context.CLIARGS['become_ask_pass']:
             cmd += ' --ask-become-pass'
         if context.CLIARGS['skip_tags']:

test/integration/targets/pull/runme.sh

@@ -23,8 +23,7 @@ cd "${repo_dir}"
     git commit -m "Initial commit."
 )
 
-ANSIBLE_CONFIG='' ansible-pull -d "${pull_dir}" -U "${repo_dir}" "$@" | tee "${temp_log}"
-
+function pass_tests {
 	# test for https://github.com/ansible/ansible/issues/13688
 	if ! grep MAGICKEYWORD "${temp_log}"; then
 	    echo "Missing MAGICKEYWORD in output."
@@ -41,3 +40,17 @@ if ! egrep 'localhost.*ok' "${temp_log}"; then
 	    echo "Did not find host localhost in output."
 	    exit 1
 	fi
+}
+
+ANSIBLE_CONFIG='' ansible-pull -d "${pull_dir}" -U "${repo_dir}" "$@" | tee "${temp_log}"
+
+pass_tests
+
+# ensure complex extra vars work
+PASSWORD='test'
+USER=${USER:-'broken_docker'}
+JSON_EXTRA_ARGS='{"docker_registries_login": [{ "docker_password": "'"${PASSWORD}"'", "docker_username": "'"${USER}"'", "docker_registry_url":"repository-manager.company.com:5001"}], "docker_registries_logout": [{ "docker_password": "'"${PASSWORD}"'", "docker_username": "'"${USER}"'", "docker_registry_url":"repository-manager.company.com:5001"}] }'
+
+ANSIBLE_CONFIG='' ansible-pull -d "${pull_dir}" -U "${repo_dir}" -e "${JSON_EXTRA_ARGS}" "$@" | tee "${temp_log}"
+
+pass_tests