Make sure that all no_log parameters are processed even if some arguments have values of the wrong type - #81672
Open
felixfontein wants to merge 1 commit into
Open
Make sure that all no_log parameters are processed even if some arguments have values of the wrong type#81672felixfontein wants to merge 1 commit into
felixfontein wants to merge 1 commit into
Conversation
ansibot
added
bug
s-hertel
added
P3
bcoca
requested changes
Sep 12, 2023
bcoca
left a comment
bcoca
left a comment
Member
There was a problem hiding this comment.
code lgtm, but would like a test to avoid regressions
ansibot
added
the
needs_revision
Contributor
Author
|
@bcoca it is impossible to test this situation without having #81631 merged, since the bug fixed by #81631 makes the module crash when the code from this PR adds an error message. Basically the test fixed in 1e61657 serves as a regression test for this PR - but only when #81631 is merged, since without it that test passes because the module crashes, and not necessarily because the code touched in this PR is correct. |
s-hertel
reviewed
Sep 13, 2023
Comment on lines
+1
to
+2
| bugfixes: | ||
| - argument spec validation - make sure that all ``no_log`` parameters are processed even if some arguments have values of the wrong type (https://github.com/ansible/ansible/pull/81672). |
Contributor
There was a problem hiding this comment.
Since this is just a preventative measure, this should probably be a minor_changes fragment.
Suggested change
| bugfixes: | |
| - argument spec validation - make sure that all ``no_log`` parameters are processed even if some arguments have values of the wrong type (https://github.com/ansible/ansible/pull/81672). | |
| minor_changes: | |
| - argument spec validation - process all ``no_log`` parameters recursively before validating the argument spec (https://github.com/ansible/ansible/pull/81672). |
Contributor
Author
There was a problem hiding this comment.
Once #81631 or something equivalent is merged, this fixes a real CVE-worthy bug.
The only reason this isn't a bug right now is that a crash in another part is preventing this bug to have any effect. It is still a bug IMO.
ansibot
added
the
stale_ci
ansibot
added
the
needs_rebase
ansibot
added
stale_review
ansibot
added
the
stale_ci
ansibot
added
the
stale_pr
ansibot
added
the
needs_rebase
ansibot
removed
needs_rebase
…ents have values of the wrong type.
ansibot
added
needs_revision
webknjaz
reviewed
Mar 19, 2026
| def _list_no_log_values(argument_spec, params, errors=None): | ||
| """Return set of no log values | ||
|
|
||
| :arg argument_spec: An argument spec dictionary |
Member
There was a problem hiding this comment.
errors missing among the params here?
ansibot
added
pending_ci
and removed
needs_revision
ansibot
added
the
stale_ci
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SUMMARY
Currently the
no_logvalue processing terminates prematurely if values that should be dictionaries or lists of dictionaries have the wrong type. This can cause values passed tono_logparameters to show up in logs. The reason why that doesn't happen right now is another bug which makes argspec validation crash in that case later on (that bug is fixed in #81631). See the discussion in #81631 for details.The patch was provided by @s-hertel in #81631 (comment), I added a changelog fragment and refactored the code slightly to remove code duplication.
ISSUE TYPE