{"action":"closed","issue":{"url":"https://api.github.com/repos/ansible/ansible/issues/22111","repository_url":"https://api.github.com/repos/ansible/ansible","labels_url":"https://api.github.com/repos/ansible/ansible/issues/22111/labels{/name}","comments_url":"https://api.github.com/repos/ansible/ansible/issues/22111/comments","events_url":"https://api.github.com/repos/ansible/ansible/issues/22111/events","html_url":"https://github.com/ansible/ansible/issues/22111","id":210934296,"number":22111,"title":"synchronize module does not escape SSH args when using `use_ssh_args`","user":{"login":"jszwedko","id":316880,"avatar_url":"https://avatars1.githubusercontent.com/u/316880?v=3","gravatar_id":"","url":"https://api.github.com/users/jszwedko","html_url":"https://github.com/jszwedko","followers_url":"https://api.github.com/users/jszwedko/followers","following_url":"https://api.github.com/users/jszwedko/following{/other_user}","gists_url":"https://api.github.com/users/jszwedko/gists{/gist_id}","starred_url":"https://api.github.com/users/jszwedko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jszwedko/subscriptions","organizations_url":"https://api.github.com/users/jszwedko/orgs","repos_url":"https://api.github.com/users/jszwedko/repos","events_url":"https://api.github.com/users/jszwedko/events{/privacy}","received_events_url":"https://api.github.com/users/jszwedko/received_events","type":"User","site_admin":false},"labels":[{"id":437720699,"url":"https://api.github.com/repos/ansible/ansible/labels/affects_2.2","name":"affects_2.2","color":"5319e7","default":false},{"id":48276055,"url":"https://api.github.com/repos/ansible/ansible/labels/bug_report","name":"bug_report","color":"fbca04","default":false},{"id":496359346,"url":"https://api.github.com/repos/ansible/ansible/labels/module","name":"module","color":"1d76db","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-02-28T23:28:27Z","updated_at":"2017-03-24T16:17:35Z","closed_at":"2017-03-24T16:17:35Z","body":"##### ISSUE TYPE\r\n - Bug Report\r\n\r\n##### COMPONENT NAME\r\n\r\n`synchronize` module\r\n\r\n##### ANSIBLE VERSION\r\n```\r\nansible 2.2.1.0\r\n  config file = /home/admin/.ansible.cfg\r\n  configured module search path = Default w/o overrides\r\n```\r\n\r\n##### CONFIGURATION\r\n\r\n```\r\n[defaults]\r\ninventory=~/bin/inventory\r\ncallback_whitelist = profile_tasks\r\nretry_files_save_path = /tmp\r\n\r\n[ssh_connection]\r\ncontrol_path = %(directory)s/%%C\r\n```\r\n\r\n##### OS / ENVIRONMENT\r\n\r\n`Linux ip-10-254-0-21 3.16.0-4-amd64 #1 SMP Debian 3.16.39-1+deb8u1 (2017-02-22) x86_64 GNU/Linux`\r\n\r\nDebian 8\r\n\r\n##### SUMMARY\r\n\r\nWe set host specific `ansible_ssh_common_args` in our dynamic inventory to tunnel through a the relevant bastion when applying changes. A given host in the inventory might look like:\r\n\r\n```\r\n      \"ip-XXXX.us-west-2.compute.internal\": {\r\n        \"ansible_ssh_common_args\": \"-o User=XXXX -o 'ProxyCommand ssh -A  -q -l XXXX X.X.X.X nc %h %p'\"\r\n      }\r\n```\r\n\r\nNote that the `-o` for the `ProxyCommand` uses `'`s.  When setting `use_ssh_args: yes` on the `synchronize` module, it attempts to pass the arguments through as the `--rsh` flag wrapped in single quotes, but does not escape single quotes within the flag value. Thus you end up with something that looks like:\r\n\r\n```\r\n.... --rsh 'ssh  -S none  -o ControlMaster=auto -o ControlPersist=60s -o User=XXXX -o 'ProxyCommand ssh -A  -q -l XXXX X.X.X.X nc %h %p'' --out-format='<<CHANGED>>%i %n%L' \"ip-XXXX.us-west-2.compute.internal:/XXXX\" \"/home/XXXX\" ....\r\n```\r\n\r\nyielding an error of:\r\n\r\n```\r\nUnexpected remote arg: ip-XXXX.us-west-2.compute.internal:/XXXX\r\n```\r\n\r\n##### STEPS TO REPRODUCE\r\n\r\n```yaml\r\n---\r\n- hosts: all\r\n  gather_facts: no\r\n  tasks:\r\n    - name: download output\r\n      synchronize:\r\n        mode: pull\r\n        src: \"XXXX\"\r\n        dest: \"XXXX\"\r\n        use_ssh_args: yes\r\n```\r\n\r\nwhere you set `ansible_ssh_common_args` to something that has a single quote in it.\r\n\r\n##### EXPECTED RESULTS\r\n\r\nThe files are fetched\r\n\r\n##### ACTUAL RESULTS\r\n\r\n```\r\nPLAY [all] *********************************************************************\r\n\r\nTASK [download output] *********************************************************\r\nTuesday 28 February 2017  23:11:51 +0000 (0:00:00.016)       0:00:00.016 ******\r\nfatal: [ip-XXXX.us-west-2.compute.internal]: FAILED! => {\"changed\": false, \"cmd\": \"/usr/bin/rsync --delay-updates -F --compress --archive --rsh 'ssh  -S none -C -o ControlMaster=auto -o ControlPersist=60s -o User=XXXX -o 'ProxyCommand ssh -A -q -l XXXX X.X.X.X nc %h %p'' --out-format='<<CHANGED>>%i %n%L' \\\"ip-XXXX.us-west-2.compute.internal:/XXXX\\\" \\\"/XXXX\\\"\", \"failed\": true, \"msg\": \"Unexpected remote arg: ip-XXXX.us-west-2.compute.internal:/XXXX\\nrsync error: syntax or usage error (code 1) at main.c(1348) [sender=3.1.1]\\n\", \"rc\": 1}\r\n        to retry, use: --limit @/tmp/XXXX.retry\r\n\r\nPLAY RECAP *********************************************************************\r\nip-XXXX.us-west-2.compute.internal : ok=0    changed=0    unreachable=0    failed=1\r\n```\r\n"}}
{"actor":{"display_login":"abadger"}}