Use SandboxedEnvironment when rendering cards (#10640)

Signed-off-by: harupy <17039389+harupy@users.noreply.github.com>
mlflow · Dec 7, 2023 · 432b8cc · 432b8cc
1 parent 42f57ff
commit 432b8cc
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/mlflow/recipes/cards/__init__.py b/mlflow/recipes/cards/__init__.py
@@ -120,9 +120,10 @@ def to_html(self) -> str:
 
         :return: a HTML string
         """
-        import jinja2
+        from jinja2 import BaseLoader
+        from jinja2.sandbox import SandboxedEnvironment
 
-        j2_env = jinja2.Environment(loader=jinja2.BaseLoader()).from_string(self.template)
+        j2_env = SandboxedEnvironment(loader=BaseLoader()).from_string(self.template)
         return j2_env.render({**self._context})