Repository navigation
Conversation
Preserve literal XCCDF values before interpolating Ansible YAML. Escape quotes, backslashes and line breaks without changing existing template quoting or other remediation formats. Co-authored-by: generaltony007 <144252170+GeneralTony007@users.noreply.github.com>
Extend the existing Ansible variable regression test with special-character fixtures and a shell-format guard. Co-authored-by: generaltony007 <144252170+GeneralTony007@users.noreply.github.com>
Cover pipe and folded indicators, quotes, backslashes, comments, colons, whitespace, line breaks, booleans, numbers and Unicode. Include prequoted templates and other fix formats as guards. Co-authored-by: generaltony007 <144252170+GeneralTony007@users.noreply.github.com>
Record the expected escaped YAML scalars while preserving numeric values, prequoted strings and task block scalars. Co-authored-by: generaltony007 <144252170+GeneralTony007@users.noreply.github.com>
hakarrr
requested review from
Mab879,
jan-cerny and
matusmarhefka
as code owners
November 10, 2026 17:46
|
Author
|
Could a maintainer review this PR and let me know if the approach is wanted? Please point out any changes or additional evidence needed before it can move forward. Thanks. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1879.
Quote standalone, explicitly tagged string substitutions (
key: !!str <sub/>) in Ansible fixes before the XCCDF value is inserted into the template. This keeps literal values such as|/bin/falsefrom being interpreted as YAML block-scalar syntax. Doing this before interpolation also distinguishes literal quote characters in an XCCDF value from quoting already supplied by the template.The generated double-quoted scalar escapes quotes, backslashes, tabs, CR/LF and Unicode line breaks. Existing template quoting, embedded substitutions, numeric variables, task block scalars and non-Ansible fixes are left unchanged. This is intentionally not a general YAML-template rewriter.
Regression coverage extends the existing Ansible variable test with 14 literal string cases, prequoted/numeric controls and a shell-fix guard. The new fixture covers pipe/folded indicators, quotes, backslashes, comment/mapping characters, leading/trailing spaces, multiline values, tabs/CR, boolean/numeric strings and Unicode.
Validation on Linux with GCC 11.4 and a native CMake build:
ctest --test-dir build -R 'API/XCCDF/(unittests|fix)' -j4 --output-on-failure: 95 passed, 3 skipped, 0 failed.ssg-rhel9-ds.xmlreproduces the YAML parse failure before the change. After the change, its generated 881-task playbook parses as YAML and preservessysctl_kernel_core_pattern_valueas the literal|/bin/false.git diff --checkpass.Build dependencies were supplied locally without tracked dependency or build-configuration changes. Documentation, Python/Perl bindings and oscap-docker were disabled. The three skipped XCCDF tests cover transformation, offline remediation and platform-specific system information. The full project suite, Ansible execution/ansible-lint, and non-Linux builds were not run. The original datastream's remote OVAL resource was not downloaded.