Commit Graph

256 Commits (93d0253292dc2e66432d96f047b66200a2d2e35b)

Author SHA1 Message Date
Martin Krizek 694f12d01b
Avoid redundant unsafe wrapping in ansible_eval_concat (#80143)
The wrap_var is done in do_template for all concat functions after their
return.
2 years ago
devon-mar 2f8f7fba4c
Update lookup to use positional only arg for name to avoid conflicts (#79839) 2 years ago
Matt Clay 27cd5e77d8
Update mypy and its dependencies. (#79812)
* Update mypy and its dependencies.

* Fix requirements.

* Remove unnecessary matching constraints.
2 years ago
Martin Krizek 60f76436c1
Simplify AnsibleJ2Vars by using ChainMap for vars (#78713)
Co-authored-by: Matt Martz <matt@sivel.net>
2 years ago
Martin Krizek d34b578685
jinja2_native: preserve quotes in strings (#79119)
Fixes #79083
2 years ago
Felix Fontein 6d0aeac1e1
Do not crash templating when filter/test name is not a valid Ansible plugin name (#78913)
* Do not crash templating when filter/test name is not a valid Ansible plugin name.
* Store and re-raise KeyError if there was one.

Co-authored-by: s-hertel <19572925+s-hertel@users.noreply.github.com>
2 years ago
Martin Krizek fcfdca8e7d
Overriding AnsibleContext.resolve is not needed/allowed (#78714)
https://github.com/pallets/jinja/pull/1393
https://github.com/pallets/jinja/pull/1544

ci_complete
2 years ago
Brian Coca 4260b71cc7
refactor and fixes for doc parsing (#77719)
* refactor and remove redundant code in documentation

  allow location and building api to be more accessible
  fix issues with displaying ansible.legacy and ansible.builtin
  ensure we don't x2 process tokens (some modules reference them also) fixes #77764
  move to constants vs hardcoded
  more informative errors and comments
  now have actual filter/test plugins, which expose the filter/test functions
  moved filter/test loading/finding logic into jinja2pluginloader, removed dupe implementations
  added tests for case in which we unique by basename when listing

Update lib/ansible/utils/plugin_docs.py
Co-authored-by: Sloane Hertel <19572925+s-hertel@users.noreply.github.com>
2 years ago
Martin Krizek 254de2a434
Templar: deprecate shared_loader_obj option (#78540) 2 years ago
Matt Davis 0591efd5e6
remove Templar caching (#78419)
* source of templating bugs (and at least one CVE), only applies to single-var values anyway
2 years ago
Matt Martz 884244f1b2
Python 3.9 min for controller (#77566) 2 years ago
Martin Krizek d070b03ad8
Fix templating nested vars with convert_data=False (#78273)
Regression introduced in #78259.
2 years ago
Martin Krizek 9afdb7fec1
template module/lookup: fix convert_data for macros (#78259)
Fixes #78141
2 years ago
Brian Coca 1f59bbf4f3
listify_lookup_plugin_terms deprecate dataloader (#78244)
* listify_lookup_plugin_terms deprecate dataloader

  deprecated useless dataloader pass to function
  also removed from callers in core


Co-authored-by: Sloane Hertel <19572925+s-hertel@users.noreply.github.com>
2 years ago
Martin Krizek 17d52c8d64
Move undefined check from concat to finalize (#78165)
* Move undefined check from concat to finalize

In the classic Jinja2's Environment str() is called on the return value of the
finalize method to potentially trigger the undefined error. That is not
the case in NativeEnvironment where string conversion of the return value is
not desired. We workaround that by checking for Undefined in all of our concat
functions. It seems simpler to do it earlier in the finalize method(s) instead.
As a side-effect it fixes an undefined variable detection in imported templates.

Fixes #78156

ci_complete

* Fix sanity

* ...

* sigh
2 years ago
Martin Krizek 39b3581316
Deprecate non lists lookups (#77875) 2 years ago
Joseph Torcasso c9ce7d08a2
template/__init__.py - fix KeyError when wantlist=False with non-list 2 years ago
Martin Krizek 3980eb8c09
Prevent losing unsafe from lookups (#77609)
* Prevent losing unsafe from lookups

This patch fixes a bug which under certain conditions results in data
returned from lookups not being marked as unsafe.

Each time Templar.do_template is invoked a new AnsibleContext is
created and stored effectively at two places:
1) as an instance variable in templar_obj.cur_context
2) as a local variable called new_context in do_template method of Templar

Due to custom functionality in Ansible's Context that allows for nested
templating it is possible that during resolving variable's value
template/do_template method is called recursively again, again creating
a new context. At that point the problem manifests itself because as
mentioned in 1) above the context is overwriten on the templar object
which means that any subsequent calls to _lookup will use the new
context to mark it as unsafe which is now different to the local
new_context which is used for testing for unsafe property.

The solution to the problem appears to be to restore the original
context inside do_template and also to eliminate the local variable
new_context to prevent problems in the future.

It appears that we don't have a better way of storing the context other
than as some form of global variable and so this appears to be the
"best" solution possible at this point. Hopefully data tagging will be
the solution here.

For more examples see unit and integration tests included in this patch.

Fixes #77535
2 years ago
Martin Krizek cbe42bff7f
Allow for lazy evaluation of Jinja2 expressions (#56116) 2 years ago
Corubba 94138cf608
template override colon bugfixes (#77495)
* Proper error on missing jinja2 override separator

Properly catch the case when no (or a wrong) separator is used in a
jinja2 override, and return a useful error message to the user.

* Support colons in jinja2 override value

By limiting the split to 1, any colons in the value are preserved and
passed on.
3 years ago
Martin Krizek c7e198b907
Ensure correct environment_class is set on Template (#77485) 3 years ago
Matt Clay f68c66a3ef Remove collections compat from controller code. 3 years ago
Sloane Hertel 8063643b4c
Fix collection redirects for filter and test plugins (#77210)
* Fix collection redirects for jinja2 filters/tests

* Handle recursive redirects

Co-authored-by: Matt Martz <matt@sivel.net>
3 years ago
Martin Krizek 8febd37f32
Attach concat func to an environment class (#76282)
* Attach concat func to an environment class

ci_complete

* clog and docstrings
3 years ago
Matt Martz 9f46f6eb30
Attempt 2: Catch errors getting filters and tests (#76806) 3 years ago
Martin Krizek 094a0746b3
ansible_concat: return strings only unless eval (#76634)
Fixes #76610
3 years ago
Martin Krizek 2058ea5991
Clarify unroll in _finalize (#76436)
Clarifies that unrolling in _finalize is actually necessary. Also using
decorator directly.
3 years ago
Martin Krizek 19a58859d6
AnsibleJ2Template should be based on NativeTemplate (#76471)
Fixes #76442

ci_complete
3 years ago
Martin Krizek 3fe42e106c
Remove finalize from globals (#76439) 3 years ago
Martin Krizek 4e7be293a5
Properly set finalize for the new environment (#76435)
* Properly set finalize for the new environment

Fixes #76379

* Fix sanity
3 years ago
Martin Krizek 382a353234
No longer needed to fall back to sha (#76281) 3 years ago
Martin Krizek 95e120ed02
Keep pre Python 3.10 literal_eval behavior (#76261) 3 years ago
Martin Krizek 26707a3c6b
Heisen jinja2_native (#75587)
* Use NativeEnvironment for all templating

ci_complete

* Keep Templar.copy_with_new_env for backwards compat

* Mention that AnsibleUndefined.__repr__ changed in the porting guide

* Templar.copy_with_new_env backwards compat

* ci_complete
3 years ago
Martin Krizek 0f95371131
Start of moving away from six (#75863)
ci_complete
3 years ago
Martin Krizek 7621784b94
Require Jinja2 3.0.0 (#75881)
* Require Jinja2 3.0.0

ci_complete

* Fix sanity

* Remove Jinja min/max tests

* ansible-test changes

* ci_complete

* More cleanup

ci_complete

* Revert _count_newlines_from_end :( and other stuff

* Fix sanity

* It's using host_vars ...

* Unused import

* Remove overridden groupby filter

* environmentfilter -> pass_environment

* Explain preserve_trailing_newlines

* Add changelog

* ci_complete

* Deprecated ANSIBLE_JINJA2_NATIVE_WARNING

* native_helpers.py cleanup

* More cleanup in the find intgration test
3 years ago
Martin Krizek 13e535c3bc
Remove deprecated Templar.set_available_variables() (#75836)
Fixes #75828
3 years ago
Matt Martz 724800cd3f
Python 3.8 Controller Minimum (#74013) 3 years ago
Daniel Goldman 989eeb243f
Add an `undef` global Jinja function (#75435)
* add tests for fail filter

also tests that fail does not block inspectability

* add fail filter

fallback message is a bit clunky,
since you can't invoke a filter without specifying an input.
That is, "{{ fail }}" doesn't work,
so you have to do "{{ None | fail }}"

* document 'fail' filter

* add changelog fragment

* fail filter uses default message on Undefined or emptystring

makes it slightly easier to use the default message:
```diff
- "{{ None | fail }}"
+ "{{ '' | fail }}"
```

and the user sees a slightly more relevant message
if the message itself is undefined:

```diff
- The error was: {{ failmsg | fail }}: 'failmsg' is undefined
+ The error was: {{ failmsg | fail }}: Mandatory variable has not been overridden
```

* rebuild as the builtin `Undefined`

* harmonise `hint` parameter for make_undefined with jinja

* use code block for documentation item

[ref](https://github.com/ansible/ansible/pull/75435#discussion_r707661035)

* rename to `undef` to expose less Python into the Jinja

[ref](https://github.com/ansible/ansible/pull/75435#pullrequestreview-757799031)

* explicitly instantiate undefined value now that it's possible

see I knew we would break something with reflection

* preserve test coverage of undefined variable

Co-authored-by: Matt Davis <nitzmahone@users.noreply.github.com>
3 years ago
Martin Krizek 3ecf438e66
jinja2_native: short-circuit literal_eval for non-strings (#75484) 3 years ago
Martin Krizek 5a38076568
Globals should be accessible when importing a template without the context (#75384)
Fixes #75371
3 years ago
Martin Krizek 767b2f07b0
Ensure Jinja2 template header overrides are used (#75306)
Fixes #75275
3 years ago
Sam Doran 5dfa9bdd9f
Check if a string is possibly a template in `ansible.template.is_template` (#75092)
* Move is_possibly_template() to function
  Call is_possibly_template() from is_template() to avoid more expensive analysis if unnecessary.
3 years ago
Martin Krizek 8ab418f41b
Disable jinja2_native warning in CI (#75214) 3 years ago
Brian Coca 4c8c40fd3d
fix unsafe preservation across newlines (#74960)
* fix unsafe preservation across newlines

  CVE-2021-3583
  ensure we always have unsafe

Co-authored-by: Rick Elrod <rick@elrod.me>
3 years ago
Matt Martz 8d1cf7f266
Vendor `distutils.version` (#74644)
* Vendor distutils.version

* Fix import order. ci_complete

* remove distutils warning filter

* Don't remove warnings filter from importer

* ci_complete

* Add pylint config for preventing distutils.version

* Add changelog fragment
3 years ago
Martin Krizek 57d661e96f
Templar: remove _fail_on_{lookup,filter}_errors (#73785)
Both were added in 62d79568be and never
used, always being set to True.
3 years ago
Matt Martz 1082e2ab79
Catch errors getting filters (#74127)
* Catch errors getting filters, and fail

* Add changelog

* Switch to warnings instead of errors, to match other plugin loader behavior

* Add tests

* Handle collections
4 years ago
Brian Coca 84e473a26e
All lookups ported to config system (#74108)
* all lookups to support config system

 - added get_options to get full dict with all opts
 - fixed tests to match new error messages
 - kept inline string k=v parsing methods for backwards compat
 - placeholder depredation for inline string k=v parsing
 - updated tests and examples to also show new way
 - refactored and added comments to most custom k=v parsing
 - added missing docs for template_vars to template
 - normalized error messages and exception types
 - fixed constants default
 - better details value errors

Co-authored-by: Felix Fontein <felix@fontein.de>
4 years ago
Brian Coca 22330dd322
Correctly set path and fullpath for template vars (#73924)
* Correctly set path and fullpath for template vars

 don't expect path to always be full path
 also added exception/tb on action fail
4 years ago
Matt Martz ba3f84883f
Reduce complexity of Templar._lookup slightly (#73277)
* A little more complexity reduction
* restore logic
* Readability
* Add ran check back
* Add clog
4 years ago