Avoid running lookup filters while evaluating jinja2 (#2821)

Fixes: #2811 Fixes: #2793 Fixes: #2681 Fixes: #2662 Fixes: #2661 Fixes: #2639
ansible · Dec 14, 2022 · bb8bca3 · bb8bca3
1 parent c444166
commit bb8bca3
Show file tree

Hide file tree

Showing 5 changed files with 17 additions and 34 deletions.
diff --git a/.github/workflows/tox.yml b/.github/workflows/tox.yml
@@ -83,7 +83,7 @@ jobs:
       WSLENV: FORCE_COLOR:PYTEST_REQPASS:TOXENV:GITHUB_STEP_SUMMARY
       # Number of expected test passes, safety measure for accidental skip of
       # tests. Update value if you add/remove tests.
-      PYTEST_REQPASS: 742
+      PYTEST_REQPASS: 741
 
     steps:
       - name: Activate WSL1

diff --git a/src/ansiblelint/rules/jinja.py b/src/ansiblelint/rules/jinja.py
@@ -552,6 +552,12 @@ def test_jinja_spacing_vars() -> None:
                 "spacing",
                 id="42",
             ),
+            pytest.param(
+                "{{ lookup('file'   ,  '/tmp/non-existent',  errors='ignore') }}",
+                "{{ lookup('file', '/tmp/non-existent', errors='ignore') }}",
+                "spacing",
+                id="43",
+            ),
         ),
     )
     def test_jinja(text: str, expected: str, tag: str) -> None:

diff --git a/src/ansiblelint/schemas/__store__.json b/src/ansiblelint/schemas/__store__.json
@@ -40,15 +40,15 @@
     "url": "https://raw.githubusercontent.com/ansible/ansible-lint/main/src/ansiblelint/schemas/molecule.json"
   },
   "playbook": {
-    "etag": "b52439e4da6993f0af5685885a4d09fa5a36826f90e9047ae2f7d89c9b92cbfa",
+    "etag": "20b5fa542890607ce3d07f4313ae3446c2dd356208e3d4341a982be93d650190",
     "url": "https://raw.githubusercontent.com/ansible/ansible-lint/main/src/ansiblelint/schemas/playbook.json"
   },
   "requirements": {
     "etag": "a11edf24f416043f2da8dd329f1d61338fc9708e017bd3cbe43d8c06e4b30090",
     "url": "https://raw.githubusercontent.com/ansible/ansible-lint/main/src/ansiblelint/schemas/requirements.json"
   },
   "tasks": {
-    "etag": "3f2ce23a880f7180cd237382f2fc201c442c4c27d9cf45c90d4d2228f53a020a",
+    "etag": "99258e1cec68edf91850e0c8663cc10ea5386a759b7ff46b9b6d366b548564b5",
     "url": "https://raw.githubusercontent.com/ansible/ansible-lint/main/src/ansiblelint/schemas/tasks.json"
   },
   "vars": {

diff --git a/src/ansiblelint/utils.py b/src/ansiblelint/utils.py
@@ -121,8 +121,16 @@ def ansible_template(
     # pylint: disable=unused-variable
     for i in range(3):
         try:
+            kwargs["disable_lookups"] = True
             return templar.template(varname, **kwargs)
         except AnsibleError as exc:
+            if (
+                "was found, however lookups were disabled from templating"
+                in exc.message
+            ):
+                # ansible core does an early exit when disable_lookup=True but
+                # this happens after the jinja2 syntax already passed.
+                break
             if (
                 exc.message.startswith("template error while templating string:")
                 and "'" in exc.message

diff --git a/test/test_utils.py b/test/test_utils.py
@@ -21,8 +21,6 @@
 from __future__ import annotations
 
 import logging
-import os
-import os.path
 import subprocess
 import sys
 from argparse import Namespace
@@ -41,7 +39,6 @@
 from ansiblelint.cli import get_rules_dirs
 from ansiblelint.constants import VIOLATIONS_FOUND_RC
 from ansiblelint.file_utils import Lintable
-from ansiblelint.testing import run_ansible_lint
 
 runtime = Runtime()
 
@@ -250,34 +247,6 @@ def test_template(template: str, output: str) -> None:
     assert result == output
 
 
-@pytest.mark.parametrize(
-    ("role", "expect_warning"),
-    (
-        ("template_lookup", False),
-        # With 2.15 ansible replaced the runtime Warning about inability to
-        # open a file in file lookup with a full error.
-        ("template_lookup_missing", runtime.version_in_range(upper="2.15.0.dev0")),
-    ),
-)
-def test_template_lookup(role: str, expect_warning: bool) -> None:
-    """Assure lookup plugins used in templates does not trigger Ansible warnings."""
-    task_path = os.path.realpath(
-        os.path.join(
-            os.path.dirname(os.path.realpath(__file__)),
-            "..",
-            "examples",
-            "roles",
-            role,
-            "tasks",
-            "main.yml",
-        )
-    )
-    result = run_ansible_lint("-v", task_path)
-    # 2.13 or older will not attempt to install when in offline mode
-    if not runtime.version_in_range(upper="2.14.0.dev0"):
-        assert ("Unable to find" in result.stderr) == expect_warning
-
-
 def test_task_to_str_unicode() -> None:
     """Ensure that extracting messages from tasks preserves Unicode."""
     task = dict(fail=dict(msg="unicode é ô à"))