From a7aa174826632c59e4fbdd7159e3cbd025a38139 Mon Sep 17 00:00:00 2001
From: "James E. Blair" <jeblair@redhat.com>
Date: Thu, 15 Mar 2018 08:52:43 -0700
Subject: [PATCH] Fix no_log bug with result lists

The combination of with_items, register, and no_log meant that we
were modifying a list which was a shared reference between the
results object used by ansible and that which we log to json.
Make a deep copy of the results object before we modify it so that
we don't modify the "original".

Also, correct a comment about the location of an import.

This adds a test which fails without the fix.

Change-Id: Iaab94f4ac8a0f58089912e464f6dfcf2e5f8ce71
---
 .../git/org_project/playbooks/no-log.yaml     | 28 +++++++++++++++++++
 zuul/ansible/callback/zuul_json.py            | 11 ++++++--
 2 files changed, 36 insertions(+), 3 deletions(-)

diff --git a/tests/fixtures/config/remote-zuul-json/git/org_project/playbooks/no-log.yaml b/tests/fixtures/config/remote-zuul-json/git/org_project/playbooks/no-log.yaml
index 57f5afb7e3..d9281c575c 100644
--- a/tests/fixtures/config/remote-zuul-json/git/org_project/playbooks/no-log.yaml
+++ b/tests/fixtures/config/remote-zuul-json/git/org_project/playbooks/no-log.yaml
@@ -9,3 +9,31 @@
         msg: setec astronomy
       no_log: true
       with_sequence: start=0 end=2
+    # The next section tests that the results object is still usable
+    # by other tasks even if we're censoring the output in zuul_json.
+    - name: Find files
+      block:
+        - name: Create file
+          copy:
+            content: ""
+            dest: "{{ ansible_user_dir }}/setec_astronomy"
+
+        - name: Find files
+          find:
+            path: "{{ ansible_user_dir }}"
+            file_type: any
+          register: src_files
+
+        - name: Dereference files
+          stat:
+            path: "{{ item.path }}"
+          with_items: "{{ src_files.files }}"
+          register: src_paths
+
+        - name: Print path
+          debug:
+            msg: "{{ item.stat.path }}"
+          when:
+            - item.stat.isreg
+          with_items: "{{ src_paths.results }}"
+      no_log: true
diff --git a/zuul/ansible/callback/zuul_json.py b/zuul/ansible/callback/zuul_json.py
index 952ad74a33..d20b2b0be4 100644
--- a/zuul/ansible/callback/zuul_json.py
+++ b/zuul/ansible/callback/zuul_json.py
@@ -22,15 +22,16 @@
 from __future__ import (absolute_import, division, print_function)
 __metaclass__ = type
 
+import copy
 import json
 import os
 
 from ansible.plugins.callback import CallbackBase
 try:
-    # It's here in 2.4
+    # It's here in 2.3
     from ansible.vars import strip_internal_keys
 except ImportError:
-    # It's here in 2.3
+    # It's here in 2.4
     from ansible.vars.manager import strip_internal_keys
 
 from zuul.ansible import logconfig
@@ -120,7 +121,11 @@ class CallbackModule(CallbackBase):
                 censored="the output has been hidden due to the fact that"
                          " 'no_log: true' was specified for this result")
         else:
-            clean_result = strip_internal_keys(result._result)
+            # strip_internal_keys makes a deep copy of dict items, but
+            # not lists, so we need to create our own complete deep
+            # copy first so we don't modify the original.
+            myresult = copy.deepcopy(result._result)
+            clean_result = strip_internal_keys(myresult)
 
             for index, item_result in enumerate(
                     clean_result.get('results', [])):