Conditional is marked as unsafe

[mueller-ma]

Using the following playbook and ansible 9.1.0 crashes Ansible, but ansible-lint doesn't detect this issue.

---
- name: Unsafe assert
  hosts: localhost
  connection: local
  become: false
  tasks:
    - name: Task with a module result (always untrusted by Ansible)
      ansible.builtin.command: echo "hi mom"
      register: untrusted_result
      changed_when: false

    - name: Insecure conditional with embedded template consulting untrusted data
      ansible.builtin.assert:
        that: '"hi mom" is in {{ untrusted_result.stdout }}'
      changed_when: false

(adapted from https://docs.ansible.com/ansible/latest/porting_guides/porting_guide_9.html#playbook)

$ ansible-lint unsafe-assert.yml
Passed: 0 failure(s), 0 warning(s) on 1 files. Last profile that met the validation criteria was 'production'.
$ ansible-playbook unsafe-assert.yml

PLAY [Unsafe assert] ********************************************************************************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************************************************************************************
ok: [localhost]

TASK [Task with a module result (always untrusted by Ansible)] **************************************************************************************************************************************************
ok: [localhost]

TASK [Insecure conditional with embedded template consulting untrusted data] ************************************************************************************************************************************
fatal: [localhost]: FAILED! => {"msg": "The conditional check '\"hi mom\" is in hi mom' failed. The error was: Conditional is marked as unsafe, and cannot be evaluated."}

PLAY RECAP ******************************************************************************************************************************************************************************************************
localhost                  : ok=2    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0

[schurzi]

We also hit that issue in our project. To get notifications for this from ansible-lint it seems like the existing rule no-jinja-when just needs to be extended to cover all affected places.

[shaaga]

How to fix this for ansible 8.5.0?

[sebix]

How to fix this for ansible 8.5.0?

Depends on the case. For the example shown above, this:

        that: '"hi mom" is in {{ untrusted_result.stdout }}'

should be instead simply:

        that: '"hi mom" is in untrusted_result.stdout'