ansible-core 2.18.4rc1__py3-none-any.whl → 2.19.0b1__py3-none-any.whl

ansible/plugins/action/set_fact.py

@@ -18,12 +18,9 @@
 from __future__ import annotations
 
 from ansible.errors import AnsibleActionFail
-from ansible.module_utils.six import string_types
 from ansible.module_utils.parsing.convert_bool import boolean
 from ansible.plugins.action import ActionBase
-from ansible.utils.vars import isidentifier
-
-import ansible.constants as C
+from ansible.utils.vars import validate_variable_name
 
 
 class ActionModule(ActionBase):
@@ -43,16 +40,10 @@ class ActionModule(ActionBase):
 
         if self._task.args:
             for (k, v) in self._task.args.items():
-                k = self._templar.template(k)
+                k = self._templar.template(k)  # a rare case where key templating is allowed; backward-compatibility for dynamic storage
 
-                if not isidentifier(k):
-                    raise AnsibleActionFail("The variable name '%s' is not valid. Variables must start with a letter or underscore character, "
-                                            "and contain only letters, numbers and underscores." % k)
+                validate_variable_name(k)
 
-                # NOTE: this should really use BOOLEANS from convert_bool, but only in the k=v case,
-                # right now it converts matching explicit YAML strings also when 'jinja2_native' is disabled.
-                if not C.DEFAULT_JINJA2_NATIVE and isinstance(v, string_types) and v.lower() in ('true', 'false', 'yes', 'no'):
-                    v = boolean(v, strict=False)
                 facts[k] = v
         else:
             raise AnsibleActionFail('No key/value pairs provided, at least one is required for this action to succeed')

ansible/plugins/action/set_stats.py

@@ -19,7 +19,7 @@ from __future__ import annotations
 
 from ansible.module_utils.parsing.convert_bool import boolean
 from ansible.plugins.action import ActionBase
-from ansible.utils.vars import isidentifier
+from ansible.utils.vars import validate_variable_name
 
 
 class ActionModule(ActionBase):
@@ -42,7 +42,7 @@ class ActionModule(ActionBase):
             data = self._task.args.get('data', {})
 
             if not isinstance(data, dict):
-                data = self._templar.template(data, convert_bare=False, fail_on_undefined=True)
+                data = self._templar.template(data)
 
             if not isinstance(data, dict):
                 result['failed'] = True
@@ -59,14 +59,9 @@ class ActionModule(ActionBase):
                         stats[opt] = val
 
             for (k, v) in data.items():
-
                 k = self._templar.template(k)
 
-                if not isidentifier(k):
-                    result['failed'] = True
-                    result['msg'] = ("The variable name '%s' is not valid. Variables must start with a letter or underscore character, and contain only "
-                                     "letters, numbers and underscores." % k)
-                    return result
+                validate_variable_name(k)
 
                 stats['data'][k] = self._templar.template(v)
 

ansible/plugins/action/template.py

@@ -20,12 +20,12 @@ from jinja2.defaults import (
 
 from ansible import constants as C
 from ansible.config.manager import ensure_type
-from ansible.errors import AnsibleError, AnsibleFileNotFound, AnsibleAction, AnsibleActionFail
+from ansible.errors import AnsibleError, AnsibleAction, AnsibleActionFail
 from ansible.module_utils.common.text.converters import to_bytes, to_text, to_native
 from ansible.module_utils.parsing.convert_bool import boolean
 from ansible.module_utils.six import string_types
 from ansible.plugins.action import ActionBase
-from ansible.template import generate_ansible_template_vars, AnsibleEnvironment
+from ansible.template import generate_ansible_template_vars, trust_as_template
 
 
 class ActionModule(ActionBase):
@@ -34,7 +34,7 @@ class ActionModule(ActionBase):
     DEFAULT_NEWLINE_SEQUENCE = "\n"
 
     def run(self, tmp=None, task_vars=None):
-        ''' handler for template operations '''
+        """ handler for template operations """
 
         if task_vars is None:
             task_vars = dict()
@@ -98,63 +98,39 @@ class ActionModule(ActionBase):
             if mode == 'preserve':
                 mode = '0%03o' % stat.S_IMODE(os.stat(source).st_mode)
 
-            # Get vault decrypted tmp file
-            try:
-                tmp_source = self._loader.get_real_file(source)
-            except AnsibleFileNotFound as e:
-                raise AnsibleActionFail("could not find src=%s, %s" % (source, to_text(e)))
-            b_tmp_source = to_bytes(tmp_source, errors='surrogate_or_strict')
-
             # template the source data locally & get ready to transfer
-            try:
-                with open(b_tmp_source, 'rb') as f:
-                    try:
-                        template_data = to_text(f.read(), errors='surrogate_or_strict')
-                    except UnicodeError:
-                        raise AnsibleActionFail("Template source files must be utf-8 encoded")
-
-                # set jinja2 internal search path for includes
-                searchpath = task_vars.get('ansible_search_path', [])
-                searchpath.extend([self._loader._basedir, os.path.dirname(source)])
-
-                # We want to search into the 'templates' subdir of each search path in
-                # addition to our original search paths.
-                newsearchpath = []
-                for p in searchpath:
-                    newsearchpath.append(os.path.join(p, 'templates'))
-                    newsearchpath.append(p)
-                searchpath = newsearchpath
-
-                # add ansible 'template' vars
-                temp_vars = task_vars.copy()
-                # NOTE in the case of ANSIBLE_DEBUG=1 task_vars is VarsWithSources(MutableMapping)
-                # so | operator cannot be used as it can be used only on dicts
-                # https://peps.python.org/pep-0584/#what-about-mapping-and-mutablemapping
-                temp_vars.update(generate_ansible_template_vars(self._task.args.get('src', None), source, dest))
-
-                # force templar to use AnsibleEnvironment to prevent issues with native types
-                # https://github.com/ansible/ansible/issues/46169
-                templar = self._templar.copy_with_new_env(environment_class=AnsibleEnvironment,
-                                                          searchpath=searchpath,
-                                                          newline_sequence=newline_sequence,
-                                                          available_variables=temp_vars)
-                overrides = dict(
-                    block_start_string=block_start_string,
-                    block_end_string=block_end_string,
-                    variable_start_string=variable_start_string,
-                    variable_end_string=variable_end_string,
-                    comment_start_string=comment_start_string,
-                    comment_end_string=comment_end_string,
-                    trim_blocks=trim_blocks,
-                    lstrip_blocks=lstrip_blocks
-                )
-                resultant = templar.do_template(template_data, preserve_trailing_newlines=True, escape_backslashes=False, overrides=overrides)
-            except AnsibleAction:
-                raise
-            except Exception as e:
-                raise AnsibleActionFail("%s: %s" % (type(e).__name__, to_text(e)))
-            finally:
-                self._loader.cleanup_tmp_file(b_tmp_source)
+            template_data = trust_as_template(self._loader.get_text_file_contents(source))
+
+            # set jinja2 internal search path for includes
+            searchpath = task_vars.get('ansible_search_path', [])
+            searchpath.extend([self._loader._basedir, os.path.dirname(source)])
+
+            # We want to search into the 'templates' subdir of each search path in
+            # addition to our original search paths.
+            newsearchpath = []
+            for p in searchpath:
+                newsearchpath.append(os.path.join(p, 'templates'))
+                newsearchpath.append(p)
+            searchpath = newsearchpath
+
+            # add ansible 'template' vars
+            temp_vars = task_vars.copy()
+            temp_vars.update(generate_ansible_template_vars(self._task.args.get('src', None), fullpath=source, dest_path=dest))
+
+            overrides = dict(
+                block_start_string=block_start_string,
+                block_end_string=block_end_string,
+                variable_start_string=variable_start_string,
+                variable_end_string=variable_end_string,
+                comment_start_string=comment_start_string,
+                comment_end_string=comment_end_string,
+                trim_blocks=trim_blocks,
+                lstrip_blocks=lstrip_blocks,
+                newline_sequence=newline_sequence,
+            )
+
+            data_templar = self._templar.copy_with_new_env(searchpath=searchpath, available_variables=temp_vars)
+            resultant = data_templar.template(template_data, escape_backslashes=False, overrides=overrides)
 
             new_task = self._task.copy()
             # mode is either the mode from task.args or the mode of the source file if the task.args

ansible/plugins/action/unarchive.py

@@ -30,7 +30,7 @@ class ActionModule(ActionBase):
     TRANSFERS_FILES = True
 
     def run(self, tmp=None, task_vars=None):
-        ''' handler for unarchive operations '''
+        """ handler for unarchive operations """
         if task_vars is None:
             task_vars = dict()
 

ansible/plugins/action/validate_argument_spec.py

@@ -10,13 +10,13 @@ from ansible.utils.vars import combine_vars
 
 
 class ActionModule(ActionBase):
-    ''' Validate an arg spec'''
+    """ Validate an arg spec"""
 
     TRANSFERS_FILES = False
     _requires_connection = False
 
     def get_args_from_task_vars(self, argument_spec, task_vars):
-        '''
+        """
         Get any arguments that may come from `task_vars`.
 
         Expand templated variables so we can validate the actual values.
@@ -25,7 +25,7 @@ class ActionModule(ActionBase):
         :param task_vars: A dict of task variables.
 
         :returns: A dict of values that can be validated against the arg spec.
-        '''
+        """
         args = {}
 
         for argument_name, argument_attrs in argument_spec.items():
@@ -35,7 +35,7 @@ class ActionModule(ActionBase):
         return args
 
     def run(self, tmp=None, task_vars=None):
-        '''
+        """
         Validate an argument specification against a provided set of data.
 
         The `validate_argument_spec` module expects to receive the arguments:
@@ -48,7 +48,7 @@ class ActionModule(ActionBase):
         :param task_vars: A dict of task variables.
         :return: An action result dict, including a 'argument_errors' key with a
             list of validation errors found.
-        '''
+        """
         if task_vars is None:
             task_vars = dict()
 

ansible/plugins/action/wait_for_connection.py

@@ -76,7 +76,7 @@ class ActionModule(ActionBase):
         del tmp  # tmp no longer has any effect
 
         def ping_module_test(connect_timeout):
-            ''' Test ping module, if available '''
+            """ Test ping module, if available """
             display.vvv("wait_for_connection: attempting ping module test")
             # re-run interpreter discovery if we ran it in the first iteration
             if self._discovered_interpreter_key:

ansible/plugins/become/__init__.py

@@ -3,6 +3,7 @@
 # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
 from __future__ import annotations
 
+import re
 import shlex
 
 from abc import abstractmethod
@@ -13,10 +14,11 @@ from gettext import dgettext
 from ansible.errors import AnsibleError
 from ansible.module_utils.common.text.converters import to_bytes
 from ansible.plugins import AnsiblePlugin
+from ansible.utils import display as _display
 
 
 def _gen_id(length=32):
-    ''' return random string used to identify the current privilege escalation '''
+    """ return random string used to identify the current privilege escalation """
     return ''.join(choice(ascii_lowercase) for x in range(length))
 
 
@@ -32,6 +34,9 @@ class BecomeBase(AnsiblePlugin):
     # plugin requires a tty, i.e su
     require_tty = False
 
+    # plugin allows for pipelining execution
+    pipelining = True
+
     # prompt to match
     prompt = ''
 
@@ -53,11 +58,11 @@ class BecomeBase(AnsiblePlugin):
 
             return getattr(playcontext, option, None)
 
-    def expect_prompt(self):
+    def expect_prompt(self) -> bool:
         """This function assists connection plugins in determining if they need to wait for
         a prompt. Both a prompt and a password are required.
         """
-        return self.prompt and self.get_option('become_pass')
+        return bool(self.prompt and self.get_option('become_pass'))
 
     def _build_success_command(self, cmd, shell, noexe=False):
         if not all((cmd, shell, self.success)):
@@ -65,9 +70,8 @@ class BecomeBase(AnsiblePlugin):
 
         try:
             cmd = shlex.quote('%s %s %s %s' % (shell.ECHO, self.success, shell.COMMAND_SEP, cmd))
-        except AttributeError:
-            # TODO: This should probably become some more robust functionality used to detect incompat
-            raise AnsibleError('The %s shell family is incompatible with the %s become plugin' % (shell.SHELL_FAMILY, self.name))
+        except AttributeError as ex:
+            raise AnsibleError(f'The {shell._load_name!r} shell plugin does not support become. It is missing the {ex.name!r} attribute.')
         exe = getattr(shell, 'executable', None)
         if exe and not noexe:
             cmd = '%s -c %s' % (exe, cmd)
@@ -78,19 +82,38 @@ class BecomeBase(AnsiblePlugin):
         self._id = _gen_id()
         self.success = 'BECOME-SUCCESS-%s' % self._id
 
+    def strip_become_prompt(self, data: bytes) -> bytes:
+        """
+        Strips the first found configured become prompt from `data`, trailing whitespace and anything that precedes the prompt, then returns the result.
+        If no prompt is expected, or the prompt is not `str` or `bytes`, `data` will be returned as-is.
+        """
+        if not self.prompt or not isinstance(self.prompt, (str, bytes)) or not self.expect_prompt():
+            return data
+
+        return self._strip_through_prefix(self.prompt, data)
+
+    def strip_become_success(self, data: bytes) -> bytes:
+        """Strips the first found success marker from `data`, trailing whitespace and anything that precedes the success marker, then returns the result."""
+        return self._strip_through_prefix(self.success, data)
+
+    @staticmethod
+    def _strip_through_prefix(match: str | bytes, data: bytes) -> bytes:
+        """Strips the first occurrence of `match` from `data`, trailing whitespace and anything that precedes `match`, then returns the result."""
+        return re.sub(br'^.*?' + re.escape(to_bytes(match)) + br'\s*', b'', data, count=1, flags=re.DOTALL)
+
     def check_success(self, b_output):
         b_success = to_bytes(self.success)
         return any(b_success in l.rstrip() for l in b_output.splitlines(True))
 
     def check_password_prompt(self, b_output):
-        ''' checks if the expected password prompt exists in b_output '''
+        """ checks if the expected password prompt exists in b_output """
         if self.prompt:
             b_prompt = to_bytes(self.prompt).strip()
             return any(l.strip().startswith(b_prompt) for l in b_output.splitlines())
         return False
 
     def _check_password_error(self, b_out, msg):
-        ''' returns True/False if domain specific i18n version of msg is found in b_out '''
+        """ returns True/False if domain specific i18n version of msg is found in b_out """
         b_fail = to_bytes(dgettext(self.name, msg))
         return b_fail and b_fail in b_out
 

ansible/plugins/become/runas.py

@@ -61,6 +61,8 @@ DOCUMENTATION = """
         - The Secondary Logon service (seclogon) must be running to use runas
 """
 
+from ansible.errors import AnsibleError
+from ansible.parsing.splitter import split_args
 from ansible.plugins.become import BecomeBase
 
 
@@ -72,3 +74,72 @@ class BecomeModule(BecomeBase):
         # this is a noop, the 'real' runas is implemented
         # inside the windows powershell execution subsystem
         return cmd
+
+    def _build_powershell_wrapper_action(self) -> tuple[str, dict[str, object], dict[str, object]]:
+        # See ansible.executor.powershell.become_wrapper.ps1 for the
+        # parameter names
+        params = {
+            'BecomeUser': self.get_option('become_user'),
+        }
+        secure_params = {}
+
+        password = self.get_option('become_pass')
+        if password:
+            secure_params['BecomePassword'] = password
+
+        flags = self.get_option('become_flags')
+        if flags:
+            split_flags = split_args(flags)
+            for flag in split_flags:
+                if '=' not in flag:
+                    raise ValueError(f"become_flags entry '{flag}' is in an invalid format, must be a key=value pair")
+
+                k, v = flag.split('=', 1)
+
+                param_name, param_value = self._parse_flag(k, v)
+                params[param_name] = param_value
+
+        return 'become_wrapper.ps1', params, secure_params
+
+    def _parse_flag(self, name: str, value: str) -> tuple[str, str]:
+        logon_types = {
+            'interactive': 'Interactive',
+            'network': 'Network',
+            'batch': 'Batch',
+            'service': 'Service',
+            'unlock': 'Unlock',
+            'network_cleartext': 'NetworkCleartext',
+            'new_credentials': 'NewCredentials',
+        }
+        logon_flags = {
+            'none': 'None',
+            'with_profile': 'WithProfile',
+            'netcredentials_only': 'NetCredentialsOnly',
+        }
+
+        match name.lower():
+            case 'logon_type':
+                param_name = 'LogonType'
+                if param_value := logon_types.get(value.lower(), None):
+                    return param_name, param_value
+                else:
+                    raise AnsibleError(f"become_flags logon_type value '{value}' is not valid, valid values are: {', '.join(logon_types.keys())}")
+
+            case 'logon_flags':
+                param_name = 'LogonFlags'
+                flags = value.split(',')
+
+                param_values: list[str] = []
+                for flag in flags:
+                    if not flag:
+                        continue
+
+                    if flag_value := logon_flags.get(flag.lower(), None):
+                        param_values.append(flag_value)
+                    else:
+                        raise AnsibleError(f"become_flags logon_flags value '{flag}' is not valid, valid values are: {', '.join(logon_flags.keys())}")
+
+                return param_name, ", ".join(param_values)
+
+            case _:
+                raise AnsibleError(f"become_flags key '{name}' is not a valid runas flag, must be 'logon_type' or 'logon_flags'")

ansible/plugins/become/su.py

@@ -93,7 +93,7 @@ DOCUMENTATION = """
 import re
 import shlex
 
-from ansible.module_utils.common.text.converters import to_bytes
+from ansible.module_utils.common.text.converters import to_text
 from ansible.plugins.become import BecomeBase
 
 
@@ -101,6 +101,8 @@ class BecomeModule(BecomeBase):
 
     name = 'su'
 
+    pipelining = False
+
     # messages for detecting prompted password issues
     fail = ('Authentication failure',)
 
@@ -139,15 +141,18 @@ class BecomeModule(BecomeBase):
         '口令',
     ]
 
-    def check_password_prompt(self, b_output):
-        ''' checks if the expected password prompt exists in b_output '''
-
+    def check_password_prompt(self, b_output: bytes) -> bool:
+        """ checks if the expected password prompt exists in b_output """
         prompts = self.get_option('prompt_l10n') or self.SU_PROMPT_LOCALIZATIONS
-        b_password_string = b"|".join((br'(\w+\'s )?' + to_bytes(p)) for p in prompts)
+        password_prompt_strings = "|".join(re.escape(p) for p in prompts)
         # Colon or unicode fullwidth colon
-        b_password_string = b_password_string + to_bytes(u' ?(:|：) ?')
-        b_su_prompt_localizations_re = re.compile(b_password_string, flags=re.IGNORECASE)
-        return bool(b_su_prompt_localizations_re.match(b_output))
+        prompt_pattern = rf"(?:{password_prompt_strings})\s*[:：]"
+        match = re.search(prompt_pattern, to_text(b_output), flags=re.IGNORECASE)
+
+        if match:
+            self.prompt = match.group(0)  # preserve the actual matched string so we can scrub the output
+
+        return bool(match)
 
     def build_become_command(self, cmd, shell):
         super(BecomeModule, self).build_become_command(cmd, shell)

ansible/plugins/become/sudo.py

@@ -72,12 +72,25 @@ DOCUMENTATION = """
             ini:
               - section: sudo_become_plugin
                 key: password
+        sudo_chdir:
+            description: Directory to change to before invoking sudo; can avoid permission errors when dropping privileges.
+            type: string
+            required: False
+            version_added: '2.19'
+            vars:
+              - name: ansible_sudo_chdir
+            env:
+              - name: ANSIBLE_SUDO_CHDIR
+            ini:
+              - section: sudo_become_plugin
+                key: chdir
 """
 
 import re
 import shlex
 
 from ansible.plugins.become import BecomeBase
+from ansible.errors import AnsibleError
 
 
 class BecomeModule(BecomeBase):
@@ -117,4 +130,10 @@ class BecomeModule(BecomeBase):
         if user:
             user = '-u %s' % (user)
 
+        if chdir := self.get_option('sudo_chdir'):
+            try:
+                becomecmd = f'{shell.CD} {shlex.quote(chdir)} {shell._SHELL_AND} {becomecmd}'
+            except AttributeError as ex:
+                raise AnsibleError(f'The {shell._load_name!r} shell plugin does not support sudo chdir. It is missing the {ex.name!r} attribute.')
+
         return ' '.join([becomecmd, flags, prompt, user, self._build_success_command(cmd, shell)])