From 39015a09a3ba5933044077d1fa9c0de86c49b996 Mon Sep 17 00:00:00 2001
From: Alisdair McDiarmid <alisdair@users.noreply.github.com>
Date: Thu, 8 Oct 2020 16:07:45 -0400
Subject: [PATCH] hclsyntax: Fix for expressions over marked values

A for expression over a marked collection should result in a new
collection with the same marks. Previously this would fail with a type
error.
---
 hclsyntax/expression.go      |  7 +++++--
 hclsyntax/expression_test.go | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/hclsyntax/expression.go b/hclsyntax/expression.go
index 76e5858..7576781 100644
--- a/hclsyntax/expression.go
+++ b/hclsyntax/expression.go
@@ -971,6 +971,9 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
 	if collVal.Type() == cty.DynamicPseudoType {
 		return cty.DynamicVal, diags
 	}
+	// Unmark collection before checking for iterability, because marked
+	// values cannot be iterated
+	collVal, marks := collVal.Unmark()
 	if !collVal.CanIterateElements() {
 		diags = append(diags, &hcl.Diagnostic{
 			Severity: hcl.DiagError,
@@ -1178,7 +1181,7 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
 			}
 		}
 
-		return cty.ObjectVal(vals), diags
+		return cty.ObjectVal(vals).WithMarks(marks), diags
 
 	} else {
 		// Producing a tuple
@@ -1254,7 +1257,7 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
 			return cty.DynamicVal, diags
 		}
 
-		return cty.TupleVal(vals), diags
+		return cty.TupleVal(vals).WithMarks(marks), diags
 	}
 }
 
diff --git a/hclsyntax/expression_test.go b/hclsyntax/expression_test.go
index 69dfacf..8faa2ec 100644
--- a/hclsyntax/expression_test.go
+++ b/hclsyntax/expression_test.go
@@ -854,6 +854,41 @@ upper(
 			}),
 			0,
 		},
+		{ // Marked sequence results in a marked tuple
+			`[for x in things: x if x != ""]`,
+			&hcl.EvalContext{
+				Variables: map[string]cty.Value{
+					"things": cty.ListVal([]cty.Value{
+						cty.StringVal("a"),
+						cty.StringVal("b"),
+						cty.StringVal(""),
+						cty.StringVal("c"),
+					}).Mark("sensitive"),
+				},
+			},
+			cty.TupleVal([]cty.Value{
+				cty.StringVal("a"),
+				cty.StringVal("b"),
+				cty.StringVal("c"),
+			}).Mark("sensitive"),
+			0,
+		},
+		{ // Marked map results in a marked object
+			`{for k, v in things: k => !v}`,
+			&hcl.EvalContext{
+				Variables: map[string]cty.Value{
+					"things": cty.MapVal(map[string]cty.Value{
+						"a": cty.True,
+						"b": cty.False,
+					}).Mark("sensitive"),
+				},
+			},
+			cty.ObjectVal(map[string]cty.Value{
+				"a": cty.False,
+				"b": cty.True,
+			}).Mark("sensitive"),
+			0,
+		},
 
 		{
 			`[{name: "Steve"}, {name: "Ermintrude"}].*.name`,