CVE-2024-8775

@@ -0,0 +1,2 @@
+bugfixes:
+  - module no_log will no longer affect top level booleans, for example ``no_log_module_parameter='a'`` will no longer hide ``changed=False`` as a 'no log value' (matches 'a').

@@ -1489,7 +1489,19 @@ def _return_formatted(self, kwargs):
         if deprecations:
             kwargs['deprecations'] = deprecations
 
+        # preserve bools/none from no_log
+        # TODO: once python version on target high enough, dict comprh
+        preserved = {}
+        for k, v in kwargs.items():
+            if v is None or isinstance(v, bool):
+                preserved[k] = v
+
+        # strip no_log collisions
         kwargs = remove_values(kwargs, self.no_log_values)
+
+        # return preserved
+        kwargs.update(preserved)
+
         print('\n%s' % self.jsonify(kwargs))
 
     def exit_json(self, **kwargs):

@@ -0,0 +1,19 @@
+#!/usr/bin/python
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+from ansible.module_utils.basic import AnsibleModule
+
+
+def main():
+    module = AnsibleModule(argument_spec=dict(
+        secret=dict(no_log=True),
+        notsecret=dict(no_log=False),
+    ))
+
+    msg = "My secret is: (%s), but don't tell %s" % (module.params['secret'], module.params['notsecret'])
+    module.exit_json(msg=msg, changed=bool(module.params['secret'] == module.params['notsecret']))
+
+
+if __name__ == '__main__':
+    main()

@@ -59,3 +59,41 @@
       # 2) the AnsibleModule.log method is not working
       - good_message in grep.stdout
       - bad_message not in grep.stdout
+
+- name: Ensure we do not obscure what we should not
+  block:
+    - module_that_has_secret:
+        secret: u
+        notsecret: u
+      register: ouch
+      ignore_errors: true
+
+    - name: no log wont obscure booleans when True, but still hide in msg
+      assert:
+        that:
+          - ouch['changed'] is boolean
+          - "'*' in ouch['msg']"
+
+    - module_that_has_secret:
+        secret: a
+        notsecret: b
+      register: ouch
+      ignore_errors: true
+
+    - name: no log wont obscure booleans when False, but still hide in msg
+      assert:
+        that:
+          - ouch['changed'] is boolean
+          - "'*' in ouch['msg']"
+
+    - module_that_has_secret:
+        secret: True
+        notsecret: False
+      register: ouch
+      ignore_errors: true
+
+    - name: no log does not hide bool values
+      assert:
+        that:
+          - ouch['changed'] is boolean
+          - "'*' not in ouch['msg']"