Wrap CLI Passwords with AnsibleUnsafeText, ensure unsafe context is not lost during encode/decode

[sivel]

SUMMARY

Convert CLI provided passwords to text initially, to
prevent unsafe context being lost when converting from bytes->text during
post processing of PlayContext. This prevents CLI provided passwords from
being incorrectly templated (CVE-2019-14856)

Update AnsibleUnsafeText and AnsibleUnsafeBytes
to maintain unsafe context by overriding .encode and .decode. This
prevents future issues with to_text, to_bytes, or to_native
removing the unsafe wrapper when converting between string types
(CVE-2019-14856)

ISSUE TYPE

• Bugfix Pull Request

COMPONENT NAME

lib/ansible/cli/__init__.py
lib/ansible/utils/unsafe_proxy.py

ADDITIONAL INFORMATION

[abadger]

+1 from me