From 5b881c6b475734927293f27a619c289a019917b9 Mon Sep 17 00:00:00 2001
From: Jakub Martin <kubam@spacelift.io>
Date: Thu, 5 Oct 2023 12:14:31 +0200
Subject: [PATCH] Fix error of conditionals with an unknown condition and
 marked branch.

Signed-off-by: Jakub Martin <kubam@spacelift.io>
---
 hclsyntax/expression.go      |  6 +++++-
 hclsyntax/expression_test.go | 12 ++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/hclsyntax/expression.go b/hclsyntax/expression.go
index 5df423fe..5ed35273 100644
--- a/hclsyntax/expression.go
+++ b/hclsyntax/expression.go
@@ -742,13 +742,17 @@ func (e *ConditionalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostic
 				}
 			}
 		}
+		_, condResultMarks := condResult.Unmark()
+		trueResult, trueResultMarks := trueResult.Unmark()
+		falseResult, falseResultMarks := falseResult.Unmark()
+
 		trueRng := trueResult.Range()
 		falseRng := falseResult.Range()
 		ret := cty.UnknownVal(resultType)
 		if trueRng.DefinitelyNotNull() && falseRng.DefinitelyNotNull() {
 			ret = ret.RefineNotNull()
 		}
-		return ret.WithSameMarks(condResult).WithSameMarks(trueResult).WithSameMarks(falseResult), diags
+		return ret.WithMarks(condResultMarks, trueResultMarks, falseResultMarks), diags
 	}
 	condResult, err := convert.Convert(condResult, cty.Bool)
 	if err != nil {
diff --git a/hclsyntax/expression_test.go b/hclsyntax/expression_test.go
index 5a6fedbc..6f761023 100644
--- a/hclsyntax/expression_test.go
+++ b/hclsyntax/expression_test.go
@@ -2015,6 +2015,18 @@ EOT
 			cty.NumberIntVal(1).Mark("sensitive"),
 			0,
 		},
+		{
+			`test ? sensitiveString : ""`,
+			&hcl.EvalContext{
+				Functions: map[string]function.Function{},
+				Variables: map[string]cty.Value{
+					"test":            cty.UnknownVal(cty.Bool),
+					"sensitiveString": cty.StringVal("test").Mark("sensitive"),
+				},
+			},
+			cty.UnknownVal(cty.String).RefineNotNull().Mark("sensitive"),
+			0,
+		},
 	}
 
 	for _, test := range tests {