diff --git a/changelogs/fragments/winrm-psrp-nolog.yml b/changelogs/fragments/winrm-psrp-nolog.yml new file mode 100644 index 00000000000..c01647635b1 --- /dev/null +++ b/changelogs/fragments/winrm-psrp-nolog.yml @@ -0,0 +1,5 @@ +security_fixes: + - >- + winrm - Do not log raw stdout/stderr on verbosity 5 when task has ``no_log: true`` set + - >- + psrp - Do not log raw stdout/stderr on verbosity 5 when task has ``no_log: true`` set diff --git a/lib/ansible/plugins/connection/psrp.py b/lib/ansible/plugins/connection/psrp.py index eeb52472fca..647422dcf02 100644 --- a/lib/ansible/plugins/connection/psrp.py +++ b/lib/ansible/plugins/connection/psrp.py @@ -767,9 +767,14 @@ class Connection(ConnectionBase): stderr_list += self.host.ui.stderr stderr = "".join([to_text(o) for o in stderr_list]) + log_stdout = stdout + log_stderr = stderr + if self._play_context.no_log: + log_stdout = log_stderr = '' + display.vvvvv("PSRP RC: %d" % rc, host=self._psrp_host) - display.vvvvv("PSRP STDOUT: %s" % stdout, host=self._psrp_host) - display.vvvvv("PSRP STDERR: %s" % stderr, host=self._psrp_host) + display.vvvvv(f"PSRP STDOUT: {log_stdout}", host=self._psrp_host) + display.vvvvv(f"PSRP STDERR: {log_stderr}", host=self._psrp_host) # reset the host back output back to defaults, needed if running # multiple pipelines on the same RunspacePool diff --git a/lib/ansible/plugins/connection/winrm.py b/lib/ansible/plugins/connection/winrm.py index 4600492ea03..d81a74870d4 100644 --- a/lib/ansible/plugins/connection/winrm.py +++ b/lib/ansible/plugins/connection/winrm.py @@ -625,11 +625,16 @@ class Connection(ConnectionBase): stdout = to_text(b_stdout) stderr = to_text(b_stderr) + log_stdout = stdout + log_stderr = stderr + if self._play_context.no_log: + log_stdout = log_stderr = '' + if from_exec: - display.vvvvv('WINRM RESULT ' % (rc, stdout, stderr), host=self._winrm_host) + display.vvvvv(f'WINRM RESULT ', host=self._winrm_host) display.vvvvvv('WINRM RC %d' % rc, host=self._winrm_host) - display.vvvvvv('WINRM STDOUT %s' % stdout, host=self._winrm_host) - display.vvvvvv('WINRM STDERR %s' % stderr, host=self._winrm_host) + display.vvvvvv(f'WINRM STDOUT {log_stdout}', host=self._winrm_host) + display.vvvvvv(f'WINRM STDERR {log_stderr}', host=self._winrm_host) # This is done after logging so we can still see the raw stderr for # debugging purposes.