Prevent RCE via inventory plugins (#815)

* Prevent RCE via inventory plugins.

* Do not make ansible_connection unsafe.

* Add test.

tests/integration/targets/inventory_docker_containers/playbooks/docker_setup.yml

@@ -25,6 +25,8 @@
         command: '/bin/sh -c "sleep 10m"'
         published_ports:
           - 22/tcp
+        labels:
+          foo: !unsafe 'EVALU{{ "" }}ATED'
       loop:
         - name: ansible-docker-test-docker-inventory-container-1
         - name: ansible-docker-test-docker-inventory-container-2

tests/integration/targets/inventory_docker_containers/playbooks/test_inventory_1.yml

@@ -25,7 +25,6 @@
         # will be other containers.
         - inventory_hostname.startswith('ansible-docker-test-docker-inventory-container-')
       block:
-
       - name: Run raw command
         raw: ls /
         register: output

tests/integration/targets/inventory_docker_containers/playbooks/test_inventory_2.yml

@@ -47,3 +47,13 @@
         # When the integration tests are run inside a docker container, there
         # will be other containers.
         - inventory_hostname.startswith('ansible-docker-test-docker-inventory-container-')
+    - name: Write labels into file
+      copy:
+        dest: "/tmp/{{ inventory_hostname }}-labels.txt"
+        content: |-
+          {{ docker_config.Labels }}
+      delegate_to: localhost
+      when:
+        # When the integration tests are run inside a docker container, there
+        # will be other containers.
+        - inventory_hostname.startswith('ansible-docker-test-docker-inventory-container-')