Error if a module is found to shadow a reserved keyword (#34649)

* Error if a module is found to shadow a reserved keyword

* Add test for shadowed module

* Bring in functools.wraps for the decorator

* Drop the decorator, make _find_plugin the real function, find_plugin now holds the shadow logic

* Swap order of functions for bottom to top execution order

* Only error for modules

* Add test for loading a lookup plugin that shadows a keyword

lib/ansible/plugins/loader.py

@@ -232,7 +232,7 @@ class PluginLoader:
                 self._paths = None
                 display.debug('Added %s to loader search path' % (directory))
 
-    def find_plugin(self, name, mod_type='', ignore_deprecated=False, check_aliases=False):
+    def _find_plugin(self, name, mod_type='', ignore_deprecated=False, check_aliases=False):
         ''' Find a plugin named name '''
 
         global _PLUGIN_FILTERS
@@ -322,6 +322,20 @@ class PluginLoader:
 
         return None
 
+    def find_plugin(self, name, mod_type='', ignore_deprecated=False, check_aliases=False):
+        ''' Find a plugin named name '''
+
+        # Import here to avoid circular import
+        from ansible.vars.reserved import is_reserved_name
+
+        plugin = self._find_plugin(name, mod_type=mod_type, ignore_deprecated=ignore_deprecated, check_aliases=check_aliases)
+        if plugin and self.package == 'ansible.modules' and is_reserved_name(name):
+            raise AnsibleError(
+                'Module "%s" shadows the name of a reserved keyword. Please rename or remove this module. Found at %s' % (name, plugin)
+            )
+
+        return plugin
+
     def has_plugin(self, name):
         ''' Checks if a plugin named name exists '''
 

lib/ansible/vars/reserved.py

@@ -77,4 +77,8 @@ def warn_if_reserved(myvars):
         display.warning('Found variable using reserved name: %s' % varname)
 
 
+def is_reserved_name(name):
+    return name in _RESERVED_NAMES
+
+
 _RESERVED_NAMES = frozenset(get_reserved_names())

test/integration/targets/shadowed_module/aliases

@@ -0,0 +1 @@
+posix/ci/group3

test/integration/targets/shadowed_module/inventory

@@ -0,0 +1 @@
+../../inventory

test/integration/targets/shadowed_module/playbook.yml

@@ -0,0 +1,6 @@
+---
+- hosts: localhost
+  gather_facts: false
+  tasks:
+    - command: whoami
+      tags: foo

test/integration/targets/shadowed_module/playbook_lookup.yml

@@ -0,0 +1,6 @@
+---
+- hosts: localhost
+  gather_facts: false
+  tasks:
+    - debug:
+        msg: "{{ lookup('vars', 'inventory_hostname') }}"

test/integration/targets/shadowed_module/runme.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+set -ux
+
+OUT=$(ansible-playbook playbook.yml -i inventory -e @../../integration_config.yml "$@" 2>&1 | grep 'ERROR! Module "tags" shadows the name of a reserved keyword.')
+
+if [[ -z "$OUT" ]]; then
+    echo "Fake tags module did not cause error"
+    exit 1
+fi
+
+# This playbook calls a lookup which shadows a keyword.
+# This is an ok situation, and should not error
+ansible-playbook playbook_lookup.yml -i inventory -e @../../integration_config.yml "$@"