ansible/ansible — pull request #8323 by victorlin (2014-07-29 01:57:00+00:00)
Title: Implement default_omit

The idea and design rationale mentioned in https://groups.google.com/forum/#!topic/ansible-project/W9bG0tAI3aU

An example, if you want to omit `git` argument when `item.gid` is not defined, you can pass arguments in dict form, then use `default_omit` filter
```yaml
- name: generic-users | Make sure all groups are present
group:
name: "{{ item.name }}"
system: "{{ item.system|default('no') }}"
# Notice: we don't need gid now, it's tricky to omit argument now
gid: "{{ item.gid|default_omit }}"
state: present
with_items: genericusers_groups
```

The way it works is pretty simple, if the value is not defined, it will return a place holder like

```
__omit_place_holder__e3e37a415b04109b9b0a7df6dce4a7f4
```

It has a random nonce as a part of it, so attackers cannot omit that value for you if they don't know the value. If the module runner sees the place holder in `complex_args` value, it will ignore that item (key and value). This is just a simple demonstration of my solution. For string based arguments, it's also possible to remove the key value pair if it sees the same place holder pattern. But just need to be careful with some corner cases.