pallets / jinja

A very fast and expressive template engine.
https://jinja.palletsprojects.com
BSD 3-Clause "New" or "Revised" License
10.25k stars 1.6k forks source link

Support for SandboxedNativeEnvironment #2010

Open pasky opened 1 month ago

pasky commented 1 month ago

We need to use NativeEnvironment since we are templating JSONs using Jinja, at the same time the templates are from untrusted sources so we need to sandbox them.

It seems to us it might be as simple as something in the vein of

class SandboxedNativeEnvironment(SandboxedEnvironment):
    code_generator_class = NativeCodeGenerator
    concat = staticmethod(native_concat)  # type: ignore

but we aren't sure if we aren't missing something?

We'll be happy to contribute a PR as a followup.