aoh

commit 402bbd5209fa752140617b79d70bdd9f31e87261
parent f0ec8f479538624528d89eab6571c6e14a0736ff
Author: Asher Morgan <asher@ashermorgan.net>
Date:   Sat, 19 Sep 2026 14:35:31 -0700

Explicitly disallow color vars in env option

Diffstat:
M
README.md
 | 
4
+++-
M
aoh/playbook.py
 | 
13
++++++++++---
M
demo/playbooks.yml
 | 
4
+++-

3 files changed, 16 insertions(+), 5 deletions(-)
diff --git a/README.md b/README.md
@@ -164,7 +164,9 @@ main.yml: # The playbook name
     - group1
     - group2
 
-  # A dictionary of environment variables to pass to ansible-playbook.
+  # A dictionary of environment variables to pass to ansible-playbook. Note that
+  # the ANSIBLE_FORCE_COLOR and ANSIBLE_NOCOLOR variables are not supported
+  # here as they are parsed client-side.
   env:
     ANSIBLE_PIPELINING: 'true'
 
diff --git a/aoh/playbook.py b/aoh/playbook.py
@@ -2,10 +2,12 @@ import os
 
 import yaml
 
-from aoh.config import AOH_PLAYBOOKS_FILE
+from aoh.config import AOH_PLAYBOOKS_DIR, AOH_PLAYBOOKS_FILE
 from aoh.security import CLI_OPT_BLACKLIST
 
-_PLAYBOOKS_DIR = os.path.dirname(AOH_PLAYBOOKS_FILE)
+_ENV_VAR_BLACKLIST = [
+    'ANSIBLE_FORCE_COLOR', 'ANSIBLE_NOCOLOR', 'NO_COLOR', # parsed client-side
+]
 
 
 class PlaybookFileError(Exception):
@@ -60,7 +62,7 @@ class Playbook:
         self.extra_args = raw.get('extra_args', [])
         self.web_description = raw.get('web_description')
 
-        self.path = os.path.abspath(os.path.join(_PLAYBOOKS_DIR, self.path))
+        self.path = os.path.abspath(os.path.join(AOH_PLAYBOOKS_DIR, self.path))
 
         if self.limit:
             if '--limit' in self.allow_opts or '-l' in self.allow_opts:
@@ -78,6 +80,11 @@ class Playbook:
                 raise PlaybookFileError(f'The "{opt}" option is not supported '
                                         'and cannot be included in extra_args')
 
+        for var in _ENV_VAR_BLACKLIST:
+            if var in self.env:
+                raise PlaybookFileError(f'The "{var}" variable is not supported'
+                                        ' and cannot be included in env')
+
 
 def get_playbook(name):
     """Lookup a playbook configuration."""
diff --git a/demo/playbooks.yml b/demo/playbooks.yml
@@ -15,7 +15,9 @@ main.yml: # The playbook name
     - group1
     - group2
 
-  # A dictionary of environment variables to pass to ansible-playbook.
+  # A dictionary of environment variables to pass to ansible-playbook. Note that
+  # the ANSIBLE_FORCE_COLOR and ANSIBLE_NOCOLOR variables are not supported
+  # here as they are parsed client-side.
   env:
     ANSIBLE_PIPELINING: 'true'