2.16 unsafe conditionals check - Just makes things harder? about ansible HOT 3 CLOSED

The basic problem that causes this failure is your approach to writing the condition, which unnecessarily embeds additional templating layers inside of something that's already a template. This means that in order to evaluate it a single template has to be run through the templating engine twice, which is unsafe (though historically allowed by Ansible.)

Splitting that embedded template into a separate variable as you did is a safe approach (the condition only needs to be templated once, and the variable only needs to be templated once), but the best way to fix the issue is to write it as a Jinja expression without any nesting.

    - name: Assert that firewall firmware version is correct
      ansible.builtin.assert:
        that: allowed_fortios_firmware_versions | select('in', _system_status.meta.version)
        fail_msg: >
          Ensure the firewall is running one of firmware {{ allowed_fortios_firmware_versions }} or,
          if you're testing a new firmware, add the firewall to the 'test' inventory group.
      when: "'test' not in group_names"

from ansible.

Files identified in the description:

• lib/ansible/utils/unsafe_proxy.py

If these files are incorrect, please update the component name section of the description or use the component bot command.

from ansible.

(allowed_fortios_firmware_versions | select('in', _system_status.meta.version)) is any

Thank you! I would have written it like this from the beginning, but I just didn't think of using select('in' ... like this...

from ansible.