From f88efd57cb0ee07f8ef2c2b1e69314d791f5419d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tadej=20Borov=C5=A1ak?=
 <70951+tadeboro@users.noreply.github.com>
Date: Wed, 19 Jan 2022 02:03:09 +0100
Subject: [PATCH] Fix zip content filtering in unarchive module (#76069)
 (#76418)

When we introduced an include parameter to the unarchive module, we
inadvertenly flipped the exclusion logic. This flip meant that the
unarchive module started rejecting files that should be extracted.

This commit flips the bad logic and adds some tests that will make
sure things do not go bad again.

(cherry picked from commit f92830d16e2fcca394a69b13e1017350e07152a3)
---
 .../76069-fix-unarchive-file-listing-in-zip.yaml  |  3 +++
 lib/ansible/modules/unarchive.py                  |  2 +-
 .../targets/unarchive/tasks/test_exclude.yml      | 15 +++++++++++++++
 3 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/fragments/76069-fix-unarchive-file-listing-in-zip.yaml

diff --git a/changelogs/fragments/76069-fix-unarchive-file-listing-in-zip.yaml b/changelogs/fragments/76069-fix-unarchive-file-listing-in-zip.yaml
new file mode 100644
index 00000000000..31b91c4d98a
--- /dev/null
+++ b/changelogs/fragments/76069-fix-unarchive-file-listing-in-zip.yaml
@@ -0,0 +1,3 @@
+bugfixes:
+- unarchive - Fix zip archive file listing that caused issues with content
+  postprocessing (https://github.com/ansible/ansible/issues/76067).
diff --git a/lib/ansible/modules/unarchive.py b/lib/ansible/modules/unarchive.py
index e4c40a9326b..38eb10bd8c7 100644
--- a/lib/ansible/modules/unarchive.py
+++ b/lib/ansible/modules/unarchive.py
@@ -386,7 +386,7 @@ class ZipArchive(object):
                         exclude_flag = False
                         if self.excludes:
                             for exclude in self.excludes:
-                                if not fnmatch.fnmatch(member, exclude):
+                                if fnmatch.fnmatch(member, exclude):
                                     exclude_flag = True
                                     break
                         if not exclude_flag:
diff --git a/test/integration/targets/unarchive/tasks/test_exclude.yml b/test/integration/targets/unarchive/tasks/test_exclude.yml
index bf9f14fb51e..8d3183c392d 100644
--- a/test/integration/targets/unarchive/tasks/test_exclude.yml
+++ b/test/integration/targets/unarchive/tasks/test_exclude.yml
@@ -11,13 +11,28 @@
     src: "{{ remote_tmp_dir }}/unarchive-00.{{item}}"
     dest: "{{ remote_tmp_dir }}/exclude-{{item}}"
     remote_src: yes
+    list_files: yes
     exclude:
       - "exclude/exclude-*.txt"
       - "other/exclude-1.ext"
+  register: result_of_unarchive
   with_items:
     - zip
     - tar
 
+- name: Make sure unarchive module reported back extracted files
+  assert:
+    that:
+      - "'include/include-1.txt' in item.files"
+      - "'include/include-2.txt' in item.files"
+      - "'include/include-3.txt' in item.files"
+      - "'other/include-1.ext' in item.files"
+      - "'other/include-2.ext' in item.files"
+      - "'other/exclude-2.ext' in item.files"
+      - "'other/other-1.ext' in item.files"
+      - "'other/other-2.ext' in item.files"
+  loop: "{{ result_of_unarchive.results }}"
+
 - name: verify that the file was unarchived
   shell: find {{ remote_tmp_dir }}/exclude-{{item}} chdir={{ remote_tmp_dir }}
   register: unarchive00