ssti

[Fxyer]

Server-side template injection occurs when user-controlled input is embedded into a server-side template, allowing users to inject template directives.

[tausbn]

Thank you for your contribution. We're currently in the process of reviewing a PR (#3396) that already implements support for detecting Server-Side Template Injections (including for Jinja2), so you may want to wait until that PR has been merged before adding more to this PR.

Also, I should add that we're currently rewriting large parts of the security analysis, so it may be best to wait until that work is done, as it will affect how we go about modelling libraries and do taint tracking. We expect this work to be done in a few months, and until then we do not plan on prioritising reviewing external submissions.

[RasmusWL]

We're doing a bit of cleaning of old PRs, so going to close this one. Thanks for the original contribution 👍