From 7f17fe4202ba88807b00830fd2fdfe572b2b6454 Mon Sep 17 00:00:00 2001
From: Alisdair McDiarmid <alisdair@users.noreply.github.com>
Date: Fri, 18 Dec 2020 13:27:49 -0500
Subject: [PATCH 1/2] hclsyntax: Fix panic for marked collection splat

---
 hclsyntax/expression.go      |  7 +++++--
 hclsyntax/expression_test.go | 17 ++++++++++++++++-
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/hclsyntax/expression.go b/hclsyntax/expression.go
index 7917853..75f13b6 100644
--- a/hclsyntax/expression.go
+++ b/hclsyntax/expression.go
@@ -1452,6 +1452,9 @@ func (e *SplatExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
 		return cty.UnknownVal(ty), diags
 	}
 
+	// Unmark the collection, and save the marks to apply to the returned
+	// collection result
+	sourceVal, marks := sourceVal.Unmark()
 	vals := make([]cty.Value, 0, sourceVal.LengthInt())
 	it := sourceVal.ElementIterator()
 	if ctx == nil {
@@ -1486,9 +1489,9 @@ func (e *SplatExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
 			diags = append(diags, tyDiags...)
 			return cty.ListValEmpty(ty.ElementType()), diags
 		}
-		return cty.ListVal(vals), diags
+		return cty.ListVal(vals).WithMarks(marks), diags
 	default:
-		return cty.TupleVal(vals), diags
+		return cty.TupleVal(vals).WithMarks(marks), diags
 	}
 }
 
diff --git a/hclsyntax/expression_test.go b/hclsyntax/expression_test.go
index 89805fc..f3bc2ca 100644
--- a/hclsyntax/expression_test.go
+++ b/hclsyntax/expression_test.go
@@ -1156,7 +1156,22 @@ upper(
 			}),
 			1,
 		},
-
+		{ // splat with sensitive collection
+			`maps.*.enabled`,
+			&hcl.EvalContext{
+				Variables: map[string]cty.Value{
+					"maps": cty.ListVal([]cty.Value{
+						cty.MapVal(map[string]cty.Value{"enabled": cty.True}),
+						cty.MapVal(map[string]cty.Value{"enabled": cty.False}),
+					}).Mark("sensitive"),
+				},
+			},
+			cty.ListVal([]cty.Value{
+				cty.True,
+				cty.False,
+			}).Mark("sensitive"),
+			0,
+		},
 		{
 			`["hello"][0]`,
 			nil,

From 9e21ad5861e83924608017c9a19acb4820fbf9e1 Mon Sep 17 00:00:00 2001
From: Alisdair McDiarmid <alisdair@users.noreply.github.com>
Date: Fri, 18 Dec 2020 14:30:01 -0500
Subject: [PATCH 2/2] Test splat of collection including marked elements

---
 hclsyntax/expression_test.go | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/hclsyntax/expression_test.go b/hclsyntax/expression_test.go
index f3bc2ca..1ff75e4 100644
--- a/hclsyntax/expression_test.go
+++ b/hclsyntax/expression_test.go
@@ -1172,6 +1172,26 @@ upper(
 			}).Mark("sensitive"),
 			0,
 		},
+		{ // splat with collection with sensitive elements
+			`maps.*.x`,
+			&hcl.EvalContext{
+				Variables: map[string]cty.Value{
+					"maps": cty.ListVal([]cty.Value{
+						cty.MapVal(map[string]cty.Value{
+							"x": cty.StringVal("foo").Mark("sensitive"),
+						}),
+						cty.MapVal(map[string]cty.Value{
+							"x": cty.StringVal("bar"),
+						}),
+					}),
+				},
+			},
+			cty.ListVal([]cty.Value{
+				cty.StringVal("foo").Mark("sensitive"),
+				cty.StringVal("bar"),
+			}),
+			0,
+		},
 		{
 			`["hello"][0]`,
 			nil,