From 759b76436af207f190bf3e2d0122fce5cb55b2e9 Mon Sep 17 00:00:00 2001
From: James Bardin <jbardin@hashicorp.com>
Date: Fri, 12 Mar 2021 12:10:25 -0500
Subject: [PATCH] validate provider_meta contains no interpolations

The provider_meta specification does not allow interpolation, but we
were not preventing it in the configuration.
---
 configs/provider_meta.go                           | 14 +++++++++++++-
 .../provider-meta/invalid-interpolation.tf         | 10 ++++++++++
 .../testdata/valid-modules/provider-meta/main.tf   |  5 +++++
 3 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 configs/testdata/invalid-modules/provider-meta/invalid-interpolation.tf
 create mode 100644 configs/testdata/valid-modules/provider-meta/main.tf

diff --git a/configs/provider_meta.go b/configs/provider_meta.go
index e49614f64..d1e817e7e 100644
--- a/configs/provider_meta.go
+++ b/configs/provider_meta.go
@@ -13,8 +13,20 @@ type ProviderMeta struct {
 }
 
 func decodeProviderMetaBlock(block *hcl.Block) (*ProviderMeta, hcl.Diagnostics) {
+	// provider_meta must be a static map. We can verify this by attempting to
+	// evaluate the values.
+	attrs, diags := block.Body.JustAttributes()
+	if diags.HasErrors() {
+		return nil, diags
+	}
+
+	for _, attr := range attrs {
+		_, d := attr.Expr.Value(nil)
+		diags = append(diags, d...)
+	}
+
 	// verify that the local name is already localized or produce an error.
-	diags := checkProviderNameNormalized(block.Labels[0], block.DefRange)
+	diags = append(diags, checkProviderNameNormalized(block.Labels[0], block.DefRange)...)
 
 	return &ProviderMeta{
 		Provider:      block.Labels[0],
diff --git a/configs/testdata/invalid-modules/provider-meta/invalid-interpolation.tf b/configs/testdata/invalid-modules/provider-meta/invalid-interpolation.tf
new file mode 100644
index 000000000..d8a0d444a
--- /dev/null
+++ b/configs/testdata/invalid-modules/provider-meta/invalid-interpolation.tf
@@ -0,0 +1,10 @@
+terraform {
+  provider_meta "my-provider" {
+    hello = var.name
+  }
+}
+
+variable "name" {
+  type = string
+}
+
diff --git a/configs/testdata/valid-modules/provider-meta/main.tf b/configs/testdata/valid-modules/provider-meta/main.tf
new file mode 100644
index 000000000..073e35b5c
--- /dev/null
+++ b/configs/testdata/valid-modules/provider-meta/main.tf
@@ -0,0 +1,5 @@
+terraform {
+  provider_meta "my-provider" {
+    hello = "test-module"
+  }
+}