validate include_role args (#28077)

* validate include_role args

* nicer error msg

* removed unused static

* updated as per feedback

* pepe ATE

lib/ansible/playbook/role_include.py

@@ -43,13 +43,17 @@ class IncludeRole(TaskInclude):
     circumstances related to the `- include_role: ...`
     """
 
+    BASE = frozenset(['name', 'role'])  # directly assigned
+    FROM_ARGS = frozenset(['tasks_from', 'vars_from', 'defaults_from'])  # used to populate from dict in role
+    OTHER_ARGS = frozenset(['private', 'allow_duplicates'])  # assigned to matching property
+    VALID_ARGS = frozenset(BASE.union(FROM_ARGS.union(OTHER_ARGS)))  # all valid args
+
     # =================================================================================
     # ATTRIBUTES
 
     # private as this is a 'module options' vs a task property
     _allow_duplicates = FieldAttribute(isa='bool', default=True, private=True)
     _private = FieldAttribute(isa='bool', default=None, private=True)
-    _static = FieldAttribute(isa='bool', default=None)
 
     def __init__(self, block=None, role=None, task_include=None):
 
@@ -100,22 +104,26 @@ class IncludeRole(TaskInclude):
 
         ir = IncludeRole(block, role, task_include=task_include).load_data(data, variable_manager=variable_manager, loader=loader)
 
-        # Process options
+        # Validate options
+        my_arg_names = frozenset(ir.args.keys())
+
         # name is needed, or use role as alias
         ir._role_name = ir.args.get('name', ir.args.get('role'))
         if ir._role_name is None:
             raise AnsibleParserError("'name' is a required field for include_role.")
 
+        # validate bad args, otherwise we silently ignore
+        bad_opts = my_arg_names.difference(IncludeRole.VALID_ARGS)
+        if bad_opts:
+            raise AnsibleParserError('Invalid options for include_role: %s' % ','.join(list(bad_opts)))
+
         # build options for role includes
-        for key in ['tasks', 'vars', 'defaults']:
+        for key in IncludeRole.FROM_ARGS.intersection(my_arg_names):
-            from_key = '%s_from' % key
+            from_key = key.replace('_from', '')
-            if ir.args.get(from_key):
+            ir._from_files[from_key] = basename(ir.args.get(key))
-                ir._from_files[key] = basename(ir.args.get(from_key))
 
-        # FIXME: find a way to make this list come from object ( attributes does not work as per below)
         # manual list as otherwise the options would set other task parameters we don't want.
-        for option in ['private', 'allow_duplicates']:
+        for option in IncludeRole.OTHER_ARGS.intersection(my_arg_names):
-            if option in ir.args:
             setattr(ir, option, ir.args.get(option))
 
         return ir