[stable-2.9] Prevent ansible_failed_task from further templating (ans…

…ible#74290)

* Prevent ansible_failed_task from further templating

Fixes ansible#74036

* Add changelog.
(cherry picked from commit 664531d)

Co-authored-by: Martin Krizek <martin.krizek@gmail.com>

changelogs/fragments/74036-unsafe-ansible_failed_task.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - Prevent ``ansible_failed_task`` from further templating (https://github.com/ansible/ansible/issues/74036)

lib/ansible/plugins/strategy/__init__.py

@@ -49,6 +49,7 @@
 from ansible.plugins import loader as plugin_loader
 from ansible.template import Templar
 from ansible.utils.display import Display
+from ansible.utils.unsafe_proxy import wrap_var
 from ansible.utils.vars import combine_vars
 from ansible.vars.clean import strip_internal_keys, module_response_deepcopy
 
@@ -577,7 +578,7 @@ def search_handler_blocks_by_name(handler_name, handler_blocks):
                         self._variable_manager.set_nonpersistent_facts(
                             original_host.name,
                             dict(
-                                ansible_failed_task=original_task.serialize(),
+                                ansible_failed_task=wrap_var(original_task.serialize()),
                                 ansible_failed_result=task_result._result,
                             ),
                         )

test/integration/targets/blocks/runme.sh

@@ -94,4 +94,9 @@ cat rc_test.out
 [ "$(grep -c 'failed=0' rc_test.out)" -eq 1 ]
 rm -f rc_test.out
 
-ansible-playbook finalized_task.yml "$@"
+# test notify inheritance
+ansible-playbook inherit_notify.yml "$@"
+
+ansible-playbook unsafe_failed_task.yml "$@"
+
+ansible-playbook finalized_task.yml "$@"

test/integration/targets/blocks/unsafe_failed_task.yml

@@ -0,0 +1,17 @@
+- hosts: localhost
+  gather_facts: false
+  vars:
+    - data: {}
+  tasks:
+    - block:
+        - name: template error
+          debug:
+            msg: "{{ data.value }}"
+      rescue:
+        - debug:
+            msg: "{{ ansible_failed_task.action }}"
+
+        - assert:
+            that:
+              - ansible_failed_task.name == "template error"
+              - ansible_failed_task.action == "debug"