From c0915e2f5ae94bff6b3548ee96e5db3ff0bcddb6 Mon Sep 17 00:00:00 2001
From: Matt Martz <matt@sivel.net>
Date: Mon, 24 Sep 2018 14:33:19 -0500
Subject: [PATCH] Support nested JSON decoding in AnsibleJSONDecoder (#45924)

* Support nested JSON decoding in AnsibleJSONDecoder

* Add tests for vault portion of AnsibleJSONDecoder
---
 changelogs/fragments/ajson-nested-decode.yaml |  2 ++
 lib/ansible/parsing/ajson.py                  | 36 ++++++++-----------
 test/units/parsing/fixtures/ajson.json        | 19 ++++++++++
 test/units/parsing/test_ajson.py              | 22 ++++++++++++
 4 files changed, 58 insertions(+), 21 deletions(-)
 create mode 100644 changelogs/fragments/ajson-nested-decode.yaml
 create mode 100644 test/units/parsing/fixtures/ajson.json
 create mode 100644 test/units/parsing/test_ajson.py

diff --git a/changelogs/fragments/ajson-nested-decode.yaml b/changelogs/fragments/ajson-nested-decode.yaml
new file mode 100644
index 00000000000..15feb133fe2
--- /dev/null
+++ b/changelogs/fragments/ajson-nested-decode.yaml
@@ -0,0 +1,2 @@
+bugfixes:
+- Ansible JSON Decoder - Switch from decode to object_hook to support nested use of __ansible_vault and __ansible_unsafe (https://github.com/ansible/ansible/pull/45514)
diff --git a/lib/ansible/parsing/ajson.py b/lib/ansible/parsing/ajson.py
index 7444a9f4035..36c693dead8 100644
--- a/lib/ansible/parsing/ajson.py
+++ b/lib/ansible/parsing/ajson.py
@@ -20,33 +20,27 @@ class AnsibleJSONDecoder(json.JSONDecoder):
 
     _vaults = {}
 
+    def __init__(self, *args, **kwargs):
+        kwargs['object_hook'] = self.object_hook
+        super(AnsibleJSONDecoder, self).__init__(*args, **kwargs)
+
     @classmethod
     def set_secrets(cls, secrets):
         cls._vaults['default'] = VaultLib(secrets=secrets)
 
-    def _decode_map(self, value):
-
-        if value.get('__ansible_unsafe', False):
-            value = wrap_var(value.get('__ansible_unsafe'))
-        elif value.get('__ansible_vault', False):
-            value = AnsibleVaultEncryptedUnicode(value.get('__ansible_vault'))
-            if self._vaults:
-                value.vault = self._vaults['default']
-        else:
-            for k in value:
-                if isinstance(value[k], Mapping):
-                    value[k] = self._decode_map(value[k])
-        return value
+    def object_hook(self, pairs):
+        for key in pairs:
+            value = pairs[key]
 
-    def decode(self, obj):
-        ''' use basic json decoding except for specific ansible objects unsafe and vault '''
+            if key == '__ansible_vault':
+                value = AnsibleVaultEncryptedUnicode(value)
+                if self._vaults:
+                    value.vault = self._vaults['default']
+                return value
+            elif key == '__ansible_unsafe':
+                return wrap_var(value.get('__ansible_unsafe'))
 
-        value = super(AnsibleJSONDecoder, self).decode(obj)
-
-        if isinstance(value, Mapping):
-            value = self._decode_map(value)
-
-        return value
+        return pairs
 
 
 # TODO: find way to integrate with the encoding modules do in module_utils
diff --git a/test/units/parsing/fixtures/ajson.json b/test/units/parsing/fixtures/ajson.json
new file mode 100644
index 00000000000..d42b7dc070a
--- /dev/null
+++ b/test/units/parsing/fixtures/ajson.json
@@ -0,0 +1,19 @@
+{
+    "password": {
+        "__ansible_vault": "$ANSIBLE_VAULT;1.1;AES256\n34646264306632313333393636316562356435376162633631326264383934326565333633366238\n3863373264326461623132613931346165636465346337310a326434313830316337393263616439\n64653937313463396366633861363266633465663730303633323534363331316164623237363831\n3536333561393238370a313330316263373938326162386433313336613532653538376662306435\n3339\n"
+    },
+    "bar": {
+        "baz": [
+            {
+                "password": {
+                    "__ansible_vault": "$ANSIBLE_VAULT;1.1;AES256\n34646264306632313333393636316562356435376162633631326264383934326565333633366238\n3863373264326461623132613931346165636465346337310a326434313830316337393263616439\n64653937313463396366633861363266633465663730303633323534363331316164623237363831\n3536333561393238370a313330316263373938326162386433313336613532653538376662306435\n3339\n"
+                }
+            }
+        ]
+    },
+    "foo": {
+        "password": {
+            "__ansible_vault": "$ANSIBLE_VAULT;1.1;AES256\n34646264306632313333393636316562356435376162633631326264383934326565333633366238\n3863373264326461623132613931346165636465346337310a326434313830316337393263616439\n64653937313463396366633861363266633465663730303633323534363331316164623237363831\n3536333561393238370a313330316263373938326162386433313336613532653538376662306435\n3339\n"
+        }
+    }
+}
diff --git a/test/units/parsing/test_ajson.py b/test/units/parsing/test_ajson.py
new file mode 100644
index 00000000000..6fb54b3775a
--- /dev/null
+++ b/test/units/parsing/test_ajson.py
@@ -0,0 +1,22 @@
+# Copyright 2018, Matt Martz <matt@sivel.net>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+import os
+import json
+
+import pytest
+
+from ansible.parsing.ajson import AnsibleJSONDecoder
+from ansible.parsing.yaml.objects import AnsibleVaultEncryptedUnicode
+
+
+def test_AnsibleJSONDecoder_vault():
+    with open(os.path.join(os.path.dirname(__file__), 'fixtures/ajson.json')) as f:
+        data = json.load(f, cls=AnsibleJSONDecoder)
+
+    assert isinstance(data['password'], AnsibleVaultEncryptedUnicode)
+    assert isinstance(data['bar']['baz'][0]['password'], AnsibleVaultEncryptedUnicode)
+    assert isinstance(data['foo']['password'], AnsibleVaultEncryptedUnicode)