Release 1.3.4.

**SECURITY** - CVE-2021-20180

Hide user sensitive information which is marked as ``secured``
while logging in console.

Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
(cherry picked from commit 1d0c5e2ba4)

Co-authored-by: Abhijeet Kasurde <akasurde@redhat.com>

.github/BOTMETA.yml

@@ -576,7 +576,7 @@ files:
   $modules/net_tools/nmcli.py:
     maintainers: alcamie101
   $modules/net_tools/snmp_facts.py:
-    maintainers: ogenstad bigmstone ujwalkomarla
+    maintainers: ogenstad ujwalkomarla
   $modules/notification/osx_say.py:
     maintainers: ansible mpdehaan
     labels: _osx_say

CHANGELOG.rst

@@ -5,6 +5,54 @@ Community General Release Notes
 .. contents:: Topics
 
 
+v1.3.4
+======
+
+Release Summary
+---------------
+
+Bugfix/security release that addresses CVE-2021-20180.
+
+Security Fixes
+--------------
+
+- bitbucket_pipeline_variable - **CVE-2021-20180** - hide user sensitive information which are marked as ``secured`` from logging into the console (https://github.com/ansible-collections/community.general/pull/1635).
+
+Bugfixes
+--------
+
+- npm - handle json decode exception while parsing command line output (https://github.com/ansible-collections/community.general/issues/1614).
+
+v1.3.3
+======
+
+Release Summary
+---------------
+
+Bugfix/security release that addresses CVE-2021-20178.
+
+Major Changes
+-------------
+
+- For community.general 2.0.0, the kubevirt modules will be moved to the `community.kubevirt <https://galaxy.ansible.com/community/kubevirt>`_ collection.
+  A redirection will be inserted so that users using ansible-base 2.10 or newer do not have to change anything.
+
+  If you use Ansible 2.9 and explicitly use kubevirt modules from this collection, you will need to adjust your playbooks and roles to use FQCNs starting with ``community.kubevirt.`` instead of ``community.general.``,
+  for example replace ``community.general.kubevirt_vm`` in a task by ``community.kubevirt.kubevirt_vm``.
+
+  If you use ansible-base and installed ``community.general`` manually and rely on the kubevirt modules, you have to make sure to install the ``community.kubevirt`` collection as well.
+  If you are using FQCNs, for example ``community.general.kubevirt_vm`` instead of ``kubevirt_vm``, it will continue working, but we still recommend to adjust the FQCNs as well.
+
+Security Fixes
+--------------
+
+- snmp_facts - **CVE-2021-20178** - hide user sensitive information such as ``privkey`` and ``authkey`` from logging into the console (https://github.com/ansible-collections/community.general/pull/1621).
+
+Bugfixes
+--------
+
+- terraform - fix ``init_reconfigure`` option for proper CLI args (https://github.com/ansible-collections/community.general/pull/1620).
+
 v1.3.2
 ======
 

changelogs/changelog.yaml

@@ -1764,3 +1764,54 @@ releases:
     - jira_improvements.yaml
     - oc-migration.yml
     release_date: '2021-01-04'
+  1.3.3:
+    changes:
+      bugfixes:
+      - terraform - fix ``init_reconfigure`` option for proper CLI args (https://github.com/ansible-collections/community.general/pull/1620).
+      major_changes:
+      - 'For community.general 2.0.0, the kubevirt modules will be moved to the `community.kubevirt
+        <https://galaxy.ansible.com/community/kubevirt>`_ collection.
+
+        A redirection will be inserted so that users using ansible-base 2.10 or newer
+        do not have to change anything.
+
+
+        If you use Ansible 2.9 and explicitly use kubevirt modules from this collection,
+        you will need to adjust your playbooks and roles to use FQCNs starting with
+        ``community.kubevirt.`` instead of ``community.general.``,
+
+        for example replace ``community.general.kubevirt_vm`` in a task by ``community.kubevirt.kubevirt_vm``.
+
+
+        If you use ansible-base and installed ``community.general`` manually and rely
+        on the kubevirt modules, you have to make sure to install the ``community.kubevirt``
+        collection as well.
+
+        If you are using FQCNs, for example ``community.general.kubevirt_vm`` instead
+        of ``kubevirt_vm``, it will continue working, but we still recommend to adjust
+        the FQCNs as well.
+
+        '
+      release_summary: Bugfix/security release that addresses CVE-2021-20178.
+      security_fixes:
+      - snmp_facts - **CVE-2021-20178** - hide user sensitive information such as
+        ``privkey`` and ``authkey`` from logging into the console (https://github.com/ansible-collections/community.general/pull/1621).
+    fragments:
+    - 1.3.3.yml
+    - 1620-terraform_init_reconfigure_fix.yml
+    - kubevirt-migration.yml
+    - snmp_facts.yml
+    release_date: '2021-01-13'
+  1.3.4:
+    changes:
+      bugfixes:
+      - npm - handle json decode exception while parsing command line output (https://github.com/ansible-collections/community.general/issues/1614).
+      release_summary: Bugfix/security release that addresses CVE-2021-20180.
+      security_fixes:
+      - bitbucket_pipeline_variable - **CVE-2021-20180** - hide user sensitive information
+        which are marked as ``secured`` from logging into the console (https://github.com/ansible-collections/community.general/pull/1635).
+    fragments:
+    - 1.3.4.yml
+    - 1614_npm.yml
+    - cve_bitbucket_pipeline_variable.yml
+    release_date: '2021-01-14'

galaxy.yml

@@ -1,6 +1,6 @@
 namespace: community
 name: general
-version: 1.3.2
+version: 1.3.4
 readme: README.md
 authors:
   - Ansible (https://github.com/ansible)

plugins/modules/cloud/misc/terraform.py

@@ -219,7 +219,7 @@ def init_plugins(bin_path, project_path, backend_config, backend_config_files, i
         for f in backend_config_files:
             command.extend(['-backend-config', f])
     if init_reconfigure:
-        command.extend('-reconfigure')
+        command.extend(['-reconfigure'])
     rc, out, err = module.run_command(command, cwd=project_path)
     if rc != 0:
         module.fail_json(msg="Failed to initialize Terraform modules:\r\n{0}".format(err))

plugins/modules/monitoring/nagios.py

@@ -19,6 +19,7 @@ module: nagios
 short_description: Perform common tasks in Nagios related to downtime and notifications.
 description:
   - "The C(nagios) module has two basic functions: scheduling downtime and toggling alerts for services or hosts."
+  - The C(nagios) module is not idempotent.
   - All actions require the I(host) parameter to be given explicitly. In playbooks you can use the C({{inventory_hostname}}) variable to refer
     to the host the playbook is currently running on.
   - You can specify multiple services at once by separating them with commas, .e.g., C(services=httpd,nfs,puppet).
@@ -26,7 +27,6 @@ description:
     e.g., C(service=host). This keyword may not be given with other services at the same time.
     I(Setting alerts/downtime/acknowledge for a host does not affect alerts/downtime/acknowledge for any of the services running on it.)
     To schedule downtime for all services on particular host use keyword "all", e.g., C(service=all).
-  - When using the C(nagios) module you will need to specify your Nagios server using the C(delegate_to) parameter.
 options:
   action:
     description:

plugins/modules/net_tools/snmp_facts.py

@@ -269,8 +269,8 @@ def main():
             level=dict(type='str', choices=['authNoPriv', 'authPriv']),
             integrity=dict(type='str', choices=['md5', 'sha']),
             privacy=dict(type='str', choices=['aes', 'des']),
-            authkey=dict(type='str'),
+            authkey=dict(type='str', no_log=True),
-            privkey=dict(type='str'),
+            privkey=dict(type='str', no_log=True),
         ),
         required_together=(
             ['username', 'level', 'integrity', 'authkey'],

plugins/modules/packaging/language/npm.py

@@ -7,39 +7,39 @@ from __future__ import absolute_import, division, print_function
 __metaclass__ = type
 
 
-DOCUMENTATION = '''
+DOCUMENTATION = r'''
 ---
 module: npm
 short_description: Manage node.js packages with npm
 description:
-  - Manage node.js packages with Node Package Manager (npm)
+  - Manage node.js packages with Node Package Manager (npm).
 author: "Chris Hoffman (@chrishoffman)"
 options:
   name:
     description:
-      - The name of a node.js library to install
+      - The name of a node.js library to install.
     type: str
     required: false
   path:
     description:
-      - The base path where to install the node.js libraries
+      - The base path where to install the node.js libraries.
     type: path
     required: false
   version:
     description:
-      - The version to be installed
+      - The version to be installed.
     type: str
     required: false
   global:
     description:
-      - Install the node.js library globally
+      - Install the node.js library globally.
     required: false
     default: no
     type: bool
   executable:
     description:
       - The executable location for npm.
-      - This is useful if you are using a version manager, such as nvm
+      - This is useful if you are using a version manager, such as nvm.
     type: path
     required: false
   ignore_scripts:
@@ -55,12 +55,12 @@ options:
     default: no
   ci:
     description:
-      - Install packages based on package-lock file, same as running npm ci
+      - Install packages based on package-lock file, same as running C(npm ci).
     type: bool
     default: no
   production:
     description:
-      - Install dependencies in production mode, excluding devDependencies
+      - Install dependencies in production mode, excluding devDependencies.
     required: false
     type: bool
     default: no
@@ -71,7 +71,7 @@ options:
     type: str
   state:
     description:
-      - The state of the node.js library
+      - The state of the node.js library.
     required: false
     type: str
     default: present
@@ -80,7 +80,7 @@ requirements:
     - npm installed in bin path (recommended /usr/local/bin)
 '''
 
-EXAMPLES = '''
+EXAMPLES = r'''
 - name: Install "coffee-script" node.js package.
   community.general.npm:
     name: coffee-script
@@ -124,12 +124,12 @@ EXAMPLES = '''
     state: present
 '''
 
+import json
 import os
 import re
 
 from ansible.module_utils.basic import AnsibleModule
-
+from ansible.module_utils._text import to_native
-import json
 
 
 class Npm(object):
@@ -155,7 +155,7 @@ class Npm(object):
         else:
             self.name_version = self.name
 
-    def _exec(self, args, run_in_check_mode=False, check_rc=True):
+    def _exec(self, args, run_in_check_mode=False, check_rc=True, add_package_name=True):
         if not self.module.check_mode or (self.module.check_mode and run_in_check_mode):
             cmd = self.executable + args
 
@@ -167,7 +167,7 @@ class Npm(object):
                 cmd.append('--ignore-scripts')
             if self.unsafe_perm:
                 cmd.append('--unsafe-perm')
-            if self.name:
+            if self.name and add_package_name:
                 cmd.append(self.name_version)
             if self.registry:
                 cmd.append('--registry')
@@ -191,7 +191,11 @@ class Npm(object):
 
         installed = list()
         missing = list()
-        data = json.loads(self._exec(cmd, True, False))
+        data = {}
+        try:
+            data = json.loads(self._exec(cmd, True, False, False) or '{}')
+        except (getattr(json, 'JSONDecodeError', ValueError)) as e:
+            self.module.fail_json(msg="Failed to parse NPM output with error %s" % to_native(e))
         if 'dependencies' in data:
             for dep in data['dependencies']:
                 if 'missing' in data['dependencies'][dep] and data['dependencies'][dep]['missing']:

plugins/modules/source_control/bitbucket/bitbucket_pipeline_variable.py

@@ -85,7 +85,7 @@ EXAMPLES = r'''
 
 RETURN = r''' # '''
 
-from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.basic import AnsibleModule, _load_params
 from ansible_collections.community.general.plugins.module_utils.source_control.bitbucket import BitbucketHelper
 
 error_messages = {
@@ -211,6 +211,14 @@ def delete_pipeline_variable(module, bitbucket, variable_uuid):
         ))
 
 
+class BitBucketPipelineVariable(AnsibleModule):
+    def __init__(self, *args, **kwargs):
+        params = _load_params() or {}
+        if params.get('secured'):
+            kwargs['argument_spec']['value'].update({'no_log': True})
+        super(BitBucketPipelineVariable, self).__init__(*args, **kwargs)
+
+
 def main():
     argument_spec = BitbucketHelper.bitbucket_argument_spec()
     argument_spec.update(
@@ -221,7 +229,7 @@ def main():
         secured=dict(type='bool', default=False),
         state=dict(type='str', choices=['present', 'absent'], required=True),
     )
-    module = AnsibleModule(
+    module = BitBucketPipelineVariable(
         argument_spec=argument_spec,
         supports_check_mode=True,
     )

tests/integration/targets/connection_chroot/aliases

@@ -1,3 +1,3 @@
 needs/root
 shippable/posix/group3
-skip/macos  # FIXME
+skip/macos # Skipped due to limitation of macOS 10.15 SIP, please read https://github.com/ansible-collections/community.general/issues/1017#issuecomment-755088895

tests/integration/targets/hg/aliases

@@ -1,4 +1,3 @@
 shippable/posix/group2
 skip/python3
 skip/aix
-disabled  # tests use bitbucket, which dropped mercurial support on 2020-08-26 (https://bitbucket.org/blog/sunsetting-mercurial-support-in-bitbucket)

tests/integration/targets/hg/tasks/main.yml

@@ -4,22 +4,9 @@
 ####################################################################
 
 # test code for the hg module
-# (c) 2014, James Tanner <tanner.jc@gmail.com>
+# Copyright: (c) 2014, James Tanner <tanner.jc@gmail.com>
-
-# This file is part of Ansible
 #
-# Ansible is free software: you can redistribute it and/or modify
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# Ansible is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
 
 - name: determine if mercurial is already installed
   command: which hg

tests/integration/targets/hg/tasks/run-tests.yml

@@ -1,27 +1,16 @@
 # test code for the hg module
-# (c) 2018, Ansible Project
+# Copyright: (c) 2018, Ansible Project
-
-# This file is part of Ansible
 #
-# Ansible is free software: you can redistribute it and/or modify
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# Ansible is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
 
 
 - name: set where to extract the repo
-  set_fact: checkout_dir={{ output_dir }}/epdb
+  set_fact:
+    checkout_dir: "{{ output_dir }}/hg_project_test"
 
 - name: set what repo to use
-  set_fact: repo=https://bitbucket.org/rpathsync/epdb
+  set_fact:
+    repo: "http://hg.pf.osdn.net/view/a/ak/akasurde/hg_project_test"
 
 - name: clean out the output_dir
   shell: rm -rf {{ output_dir }}/*
@@ -30,7 +19,9 @@
   shell: which hg
 
 - name: initial checkout
-  hg: repo={{ repo }} dest={{ checkout_dir }}
+  hg:
+    repo: "{{ repo }}"
+    dest: "{{ checkout_dir }}"
   register: hg_result
 
 - debug: var=hg_result
@@ -46,17 +37,21 @@
       - "hg_result.changed"
 
 - name: repeated checkout
-  hg: repo={{ repo }} dest={{ checkout_dir }}
+  hg:
+    repo: "{{ repo }}"
+    dest: "{{ checkout_dir }}"
   register: hg_result2
 
 - debug: var=hg_result2
 
 - name: check for tags
-  stat: path={{ checkout_dir }}/.hgtags
+  stat:
+    path: "{{ checkout_dir }}/.hgtags"
   register: tags
 
 - name: check for remotes
-  stat: path={{ checkout_dir }}/.hg/branch
+  stat:
+    path: "{{ checkout_dir }}/.hg/branch"
   register: branches
 
 - debug: var=tags
@@ -68,13 +63,16 @@
       - "tags.stat.isreg"
       - "branches.stat.isreg"
 
-- name: verify on a reclone things are marked unchanged
+- name: verify on a re-clone things are marked unchanged
   assert:
     that:
       - "not hg_result2.changed"
 
 - name: Checkout non-existent repo clone
-  hg: repo=https://bitbucket.org/pyro46/pythonscript_1 clone=no update=no
+  hg:
+    repo: "http://hg.pf.osdn.net/view/a/ak/akasurde/hg_project_test_1"
+    clone: no
+    update: no
   register: hg_result3
   ignore_errors: true
 

tests/integration/targets/monit/aliases

@@ -6,3 +6,4 @@ skip/macos
 skip/freebsd
 skip/aix
 skip/python2.6  # python-daemon package used in integration tests requires >=2.7
+skip/rhel  # FIXME

tests/unit/plugins/modules/packaging/language/test_npm.py

@@ -0,0 +1,70 @@
+#
+# Copyright: (c) 2021, Abhijeet Kasurde <akasurde@redhat.com>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+from ansible_collections.community.general.tests.unit.compat.mock import call, patch
+from ansible_collections.community.general.plugins.modules.packaging.language import npm
+from ansible_collections.community.general.tests.unit.plugins.modules.utils import (
+    AnsibleExitJson, AnsibleFailJson, ModuleTestCase, set_module_args)
+
+
+class NPMModuleTestCase(ModuleTestCase):
+    module = npm
+
+    def setUp(self):
+        super(NPMModuleTestCase, self).setUp()
+        ansible_module_path = "ansible_collections.community.general.plugins.modules.packaging.language.npm.AnsibleModule"
+        self.mock_run_command = patch('%s.run_command' % ansible_module_path)
+        self.module_main_command = self.mock_run_command.start()
+        self.mock_get_bin_path = patch('%s.get_bin_path' % ansible_module_path)
+        self.get_bin_path = self.mock_get_bin_path.start()
+        self.get_bin_path.return_value = '/testbin/npm'
+
+    def tearDown(self):
+        self.mock_run_command.stop()
+        self.mock_get_bin_path.stop()
+        super(NPMModuleTestCase, self).tearDown()
+
+    def module_main(self, exit_exc):
+        with self.assertRaises(exit_exc) as exc:
+            self.module.main()
+        return exc.exception.args[0]
+
+    def test_present(self):
+        set_module_args({
+            'name': 'coffee-script',
+            'global': 'true',
+            'state': 'present'
+        })
+        self.module_main_command.side_effect = [
+            (0, '{}', ''),
+            (0, '{}', ''),
+        ]
+
+        result = self.module_main(AnsibleExitJson)
+
+        self.assertTrue(result['changed'])
+        self.module_main_command.assert_has_calls([
+            call(['/testbin/npm', 'list', '--json', '--long', '--global'], check_rc=False, cwd=None),
+        ])
+
+    def test_absent(self):
+        set_module_args({
+            'name': 'coffee-script',
+            'global': 'true',
+            'state': 'absent'
+        })
+        self.module_main_command.side_effect = [
+            (0, '{"dependencies": {"coffee-script": {}}}', ''),
+            (0, '{}', ''),
+        ]
+
+        result = self.module_main(AnsibleExitJson)
+
+        self.assertTrue(result['changed'])
+        self.module_main_command.assert_has_calls([
+            call(['/testbin/npm', 'uninstall', '--global', 'coffee-script'], check_rc=True, cwd=None),
+        ])