"Invalid character" when evaluating expressions with directives

[adriannieto-attechnest]

Latest ruleset (0.2.0) is not able to check terraform code, this doesn't not happen with version 0.1.1:

Broken code:

resource "local_file" "inventory" {
    filename = "${var.inventory_dir}/hosts.yaml"
    content = <<HOSTS
all:
  children:
    bastion:
      hosts:
%{ for addr in module.bastion.public_ip[*] ~}
        ${addr}
%{ endfor ~}   
HOSTS
}

Error:

tflint                                                                                                                                                
Failed to check ruleset; Failed to check `terraform_deprecated_index` rule: environment.tf:9,9-10: Invalid character; This character is not used within the language., and 183 other diagnostic(s)

Plugin config:

plugin "terraform" {
  enabled = true
  version = "0.2.0"
  source  = "github.com/terraform-linters/tflint-ruleset-terraform"
  preset  = "recommended"
}

plugin "aws" {
    enabled = true
    deep_check = false
    version = "0.17.1"
    source  = "github.com/terraform-linters/tflint-ruleset-aws"    
}

Versions:

tf version                                                                                                                                       
Terraform v1.3.3
on darwin_arm64
+ provider registry.terraform.io/hashicorp/aws v4.24.0
+ provider registry.terraform.io/hashicorp/dns v3.2.3
+ provider registry.terraform.io/hashicorp/local v2.2.3
+ provider registry.terraform.io/hashicorp/tls v4.0.1

tflint -v                                                                                                                                               
TFLint version 0.42.0
+ ruleset.terraform (0.2.0)
+ ruleset.aws (0.17.1)

[bendrucker]

Moved to tflint as it seems very unlikely this is localized to the terraform ruleset, meaning the root cause is the CLI or plugin SDK. Assuming that's the case, this bug would arise anytime a plugin tries to evaluate an attribute containing a directive in its expression. The terraform ruleset just does a lot of meta-evaluation, i.e. visiting all resource attributes rather than 1 specific one.

[adriannieto-attechnest]

Just in case this is happening only in version 2.0.0, previous version is unaffected.

…

On Tue, 25 Oct 2022 at 00:09, Ben Drucker ***@***.***> wrote: Moved to tflint as it seems very unlikely this is localized to the terraform ruleset, meaning the root cause is the CLI or plugin SDK. Assuming that' the case, this bug would arise anytime a plugin tries to evaluate an attribute containing a directive in its expression. The terraform ruleset just does a lot of meta-evaluation, i.e. visiting all resource attributes rather than 1 specific one. — Reply to this email directly, view it on GitHub <#42>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AVB2V7KJE5JKJDDIVEENPP3WE4CKRANCNFSM6AAAAAARNMTUWU> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[pdecat]

Using TFLint version 0.42.1, downgrading the terraform ruleset from 0.2.0-bundled to 0.1.1 does not help for me:

# tflint -v
TFLint version 0.42.1
+ ruleset.terraform (0.2.0-bundled)

# pre-commit run --all-files terraform_tflint
Terraform validate with tflint...........................................Failed
- hook id: terraform_tflint
- exit code: 1

Command 'tflint --init' successfully done:




TFLint in modules/deploy/:
Failed to check ruleset; Failed to check `terraform_deprecated_index` rule: main.tf:52,8-9: Invalid character; This character is not used within the language., and 57 other diagnostic(s)

# cat <<EOF > .tflint.hcl
plugin "terraform" {
    enabled = true
    version = "0.1.1"
    source  = "github.com/terraform-linters/tflint-ruleset-terraform"
}
EOF

# tflint --init
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.1.1)

# tflint --version
TFLint version 0.42.1
+ ruleset.terraform (0.1.1)

# pre-commit run --all-files terraform_tflint
Terraform validate with tflint...........................................Failed
- hook id: terraform_tflint
- exit code: 1

Command 'tflint --init' successfully done:
Plugin `terraform` is already installed



TFLint in modules/deploy/:
Failed to check ruleset; Failed to check `terraform_deprecated_index` rule: main.tf:52,8-9: Invalid character; This character is not used within the language., and 57 other diagnostic(s)

For a complete job log, see https://github.com/terraform-aws-modules/terraform-aws-lambda/actions/runs/3312065827/jobs/5468288824

[bendrucker]

Hmm, so debugging from the bottom up identified this as the source of the error diagnostics:

tflint-ruleset-terraform/rules/terraform_deprecated_index.go

Line 67 in 0874219

tokens, diags := hclsyntax.LexExpression(bytes, filename, variable.SourceRange().Start)

I'm able to reproduce the error in the tests on v0.2.0, but not v0.1.1. Which means that #34 is the root cause, via evaluating more expressions than previous. Presumably Terraform handles these directive expressions as a special case.