blob: 678e5a2c9b5cb1dee39cd613527ecb8c9d68ef5c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
|
import re
from ansiblelint.rules import AnsibleLintRule
class ShellWithoutPipefail(AnsibleLintRule):
id = '306'
shortdesc = 'Shells that use pipes should set the pipefail option'
description = (
'Without the pipefail option set, a shell command that '
'implements a pipeline can fail and still return 0. If '
'any part of the pipeline other than the terminal command '
'fails, the whole pipeline will still return 0, which may '
'be considered a success by Ansible. '
'Pipefail is available in the bash shell.'
)
severity = 'MEDIUM'
tags = ['command-shell']
version_added = 'v4.1.0'
_pipefail_re = re.compile(r"^\s*set.*[+-][A-z]*o\s*pipefail")
_pipe_re = re.compile(r"(?<!\|)\|(?!\|)")
def matchtask(self, file, task):
if task["__ansible_action_type__"] != "task":
return False
if task["action"]["__ansible_module__"] != "shell":
return False
if task.get("ignore_errors"):
return False
unjinjad_cmd = self.unjinja(
' '.join(task["action"].get("__ansible_arguments__", [])))
return (self._pipe_re.search(unjinjad_cmd) and
not self._pipefail_re.match(unjinjad_cmd))
|
