1 files changed, 18 insertions, 8 deletions
diff --git a/lib/expand_variables.rb b/lib/expand_variables.rb
index 51a66958ba0..ad5aabfa1f3 100644
--- a/lib/expand_variables.rb
+++ b/lib/expand_variables.rb
@@ -1,18 +1,24 @@
 # frozen_string_literal: true
 
 module ExpandVariables
-  VARIABLES_REGEXP = /\$([a-zA-Z_][a-zA-Z0-9_]*)|\${\g<1>}|%\g<1>%/.freeze
+  VariableExpansionError = Class.new(StandardError)
+
+  VARIABLES_REGEXP = /\$([a-zA-Z_][a-zA-Z0-9_]*)|\${\g<1>}|%\g<1>%/
 
   class << self
-    def expand(value, variables, expand_file_refs: true)
+    def expand(value, variables, expand_file_refs: true, fail_on_masked: false)
       replace_with(value, variables) do |collection, last_match|
-        match_or_blank_value(collection, last_match, expand_file_refs: expand_file_refs)
+        match_or_blank_value(
+          collection, last_match, expand_file_refs: expand_file_refs, fail_on_masked: fail_on_masked
+        )
       end
     end
 
-    def expand_existing(value, variables, expand_file_refs: true)
+    def expand_existing(value, variables, expand_file_refs: true, fail_on_masked: false)
       replace_with(value, variables) do |collection, last_match|
-        match_or_original_value(collection, last_match, expand_file_refs: expand_file_refs)
+        match_or_original_value(
+          collection, last_match, expand_file_refs: expand_file_refs, fail_on_masked: fail_on_masked
+        )
       end
     end
 
@@ -36,12 +42,14 @@ module ExpandVariables
       end
     end
 
-    def match_or_blank_value(collection, last_match, expand_file_refs:)
+    def match_or_blank_value(collection, last_match, expand_file_refs:, fail_on_masked:)
       match = last_match[1] || last_match[2]
       replacement = collection[match]
 
       if replacement.nil?
         nil
+      elsif fail_on_masked && replacement.masked?
+        raise VariableExpansionError, 'masked variables cannot be expanded'
       elsif replacement.file?
         expand_file_refs ? replacement.value : last_match
       else
@@ -49,8 +57,10 @@ module ExpandVariables
       end
     end
 
-    def match_or_original_value(collection, last_match, expand_file_refs:)
-      match_or_blank_value(collection, last_match, expand_file_refs: expand_file_refs) || last_match[0]
+    def match_or_original_value(collection, last_match, expand_file_refs:, fail_on_masked:)
+      match_or_blank_value(
+        collection, last_match, expand_file_refs: expand_file_refs, fail_on_masked: fail_on_masked
+      ) || last_match[0]
     end
   end
 end