From 8a409f37db0875d05c7d8a85554172573fb93cf9 Mon Sep 17 00:00:00 2001
From: Andrew Gaffney <andrew@agaffney.org>
Date: Thu, 5 Dec 2019 07:54:32 -0800
Subject: [PATCH] Throw an error on unsupported vars_prompt keys (#65487)

---
 .../vars_prompt_error_on_unsupported_key.yaml  |  2 ++
 lib/ansible/playbook/play.py                   |  8 +++++---
 .../targets/vars_prompt/test-vars_prompt.py    |  6 ++++++
 .../targets/vars_prompt/unsupported.yml        | 18 ++++++++++++++++++
 4 files changed, 31 insertions(+), 3 deletions(-)
 create mode 100644 changelogs/fragments/vars_prompt_error_on_unsupported_key.yaml
 create mode 100644 test/integration/targets/vars_prompt/unsupported.yml

diff --git a/changelogs/fragments/vars_prompt_error_on_unsupported_key.yaml b/changelogs/fragments/vars_prompt_error_on_unsupported_key.yaml
new file mode 100644
index 0000000000..d79f3721a9
--- /dev/null
+++ b/changelogs/fragments/vars_prompt_error_on_unsupported_key.yaml
@@ -0,0 +1,2 @@
+minor_changes:
+- vars_prompt - throw error when encountering unsupported key
diff --git a/lib/ansible/playbook/play.py b/lib/ansible/playbook/play.py
index eaf598d2ce..f84fff09e5 100644
--- a/lib/ansible/playbook/play.py
+++ b/lib/ansible/playbook/play.py
@@ -211,9 +211,11 @@ class Play(Base, Taggable, CollectionSearch):
         if new_ds is not None:
             for prompt_data in new_ds:
                 if 'name' not in prompt_data:
-                    raise AnsibleParserError("Invalid vars_prompt data structure", obj=ds)
-                else:
-                    vars_prompts.append(prompt_data)
+                    raise AnsibleParserError("Invalid vars_prompt data structure, missing 'name' key", obj=ds)
+                for key in prompt_data:
+                    if key not in ('name', 'prompt', 'default', 'private', 'confirm', 'encrypt', 'salt_size', 'salt', 'unsafe'):
+                        raise AnsibleParserError("Invalid vars_prompt data structure, found unsupported key '%s'" % key, obj=ds)
+                vars_prompts.append(prompt_data)
         return vars_prompts
 
     def _compile_roles(self):
diff --git a/test/integration/targets/vars_prompt/test-vars_prompt.py b/test/integration/targets/vars_prompt/test-vars_prompt.py
index f5680618a5..6c805fdd90 100644
--- a/test/integration/targets/vars_prompt/test-vars_prompt.py
+++ b/test/integration/targets/vars_prompt/test-vars_prompt.py
@@ -115,6 +115,12 @@ tests = [
      'test_spec': [
          [('prompting for variable:', '{{whole}}\r')],
          r'testhost.*ok=2']},
+
+    # Test unsupported keys
+    {'playbook': 'unsupported.yml',
+     'test_spec': [
+         [],
+         "Invalid vars_prompt data structure, found unsupported key 'when'"]},
 ]
 
 for t in tests:
diff --git a/test/integration/targets/vars_prompt/unsupported.yml b/test/integration/targets/vars_prompt/unsupported.yml
new file mode 100644
index 0000000000..eab02fd64f
--- /dev/null
+++ b/test/integration/targets/vars_prompt/unsupported.yml
@@ -0,0 +1,18 @@
+- name: Test vars_prompt unsupported key
+  hosts: testhost
+  become: no
+  gather_facts: no
+  vars_prompt:
+    - name: input
+      prompt: prompting for variable
+      # Unsupported key for vars_prompt
+      when: foo is defined
+
+  tasks:
+    - name:
+      assert:
+        that:
+          - input is not defined
+
+    - debug:
+        var: input