Sanitize labels. (#985)

plugins/module_utils/module_container/base.py

@@ -22,6 +22,7 @@ from ansible_collections.community.docker.plugins.module_utils.util import (
     compare_generic,
     normalize_healthcheck,
     omit_none_from_dict,
+    sanitize_labels,
 )
 
 from ansible_collections.community.docker.plugins.module_utils._platform import (
@@ -651,6 +652,17 @@ def _preprocess_mounts(module, values):
     return values
 
 
+def _preprocess_labels(module, values):
+    result = {}
+    if 'labels' in values:
+        labels = values['labels']
+        if labels is not None:
+            labels = dict(labels)
+            sanitize_labels(labels, 'labels', module=module)
+        result['labels'] = labels
+    return result
+
+
 def _preprocess_log(module, values):
     result = {}
     if 'log_driver' not in values:
@@ -978,7 +990,7 @@ OPTION_KERNEL_MEMORY = (
 )
 
 OPTION_LABELS = (
-    OptionGroup()
+    OptionGroup(preprocess=_preprocess_labels)
     .add_option('labels', type='dict', needs_no_suboptions=True)
 )
 

plugins/module_utils/util.py

@@ -12,7 +12,9 @@ from datetime import timedelta
 
 from ansible.module_utils.basic import env_fallback
 from ansible.module_utils.common.collections import is_sequence
+from ansible.module_utils.six import string_types
 from ansible.module_utils.six.moves.urllib.parse import urlparse
+from ansible.module_utils.common.text.converters import to_text
 
 
 DEFAULT_DOCKER_HOST = 'unix:///var/run/docker.sock'
@@ -277,6 +279,28 @@ class DifferenceTracker(object):
         return result
 
 
+def sanitize_labels(labels, labels_field, client=None, module=None):
+    def fail(msg):
+        if client is not None:
+            client.module.fail(msg)
+        if module is not None:
+            module.fail_json(msg=msg)
+        raise ValueError(msg)
+
+    if labels is None:
+        return
+    for k, v in list(labels.items()):
+        if not isinstance(k, string_types):
+            fail(
+                "The key {key!r} of {field} is not a string!".format(
+                    field=labels_field, key=k))
+        if isinstance(v, (bool, float)):
+            fail(
+                "The value {value!r} for {key!r} of {field} is not a string or something than can be safely converted to a string!".format(
+                    field=labels_field, key=k, value=v))
+        labels[k] = to_text(v)
+
+
 def clean_dict_booleans_for_docker_api(data, allow_sequences=False):
     '''
     Go doesn't like Python booleans 'True' or 'False', while Ansible is just