Add a Sensitive datatype that does nothing

[PierreR]

First step for #245

[PierreR]

To be useful, it at least needs to prevent throwing an error on such erb call:
auth.ldap.bindpw: <%= @ldap_pwd.unwrap %>
This does not work:

modified   ruby/hrubyerb.rb
@@ -48,6 +48,11 @@ class Scope
         vl('~g~e~t_h~a~s~h~')
     end
 
+    def function_unwrap(args)
+        put '~u~n~w_r~a~p~'
+        args
+    end
+
     def function_to_yaml(args)
         args.to_yaml
     end
@@ -117,4 +122,3 @@ class Controller
         nerb.result(binding.get_binding)
     end
 end
-

Any idea ?

[PierreR]

@bartavelle Is this alright ?

[bartavelle]

I do not think this is alright. If you want it to work "right", you should create a new datatype for the interpreter, and it should only match that.

It seems impossible to validate it properly without adding special logic. Indeed, it says:

The Sensitive type is parameterized, but the parameterized type (the type of the value it contains) only retains the basic type, but sensitive information about the length or details about the contained data value can be leaked.

[bartavelle]

You can write a ruby to haskell binding so that it can call unwrap.

[PierreR]

Where do I write such binding ?

[bartavelle]

probably in the Puppet.Runner.Erb module. Look at how the varlookup function is exported to the ruby runtime