Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enforce sandboxed rendering for Jinja2 templates. #3074

Merged
merged 3 commits into from
Jan 4, 2023
Merged

Enforce sandboxed rendering for Jinja2 templates. #3074

merged 3 commits into from
Jan 4, 2023

Conversation

jathanism
Copy link
Contributor

Closes: DNE

What's Changed

As a preventative measure, this change forces the Jinja2 template engine to use a SandboxedEnvironment.

  • This addresses any unsafe code execution everywhere render_jinja2 is called.
  • Test added to assert that unsafe object attributes cannot be accessed and will result in a SecurityError.
  • Documentation referencing direct use of jinja2.Template replaced with render_jinja2

TODO

  • Explanation of Change(s)
  • Added change log fragment(s) (for more information see the documentation)
  • Attached Screenshots, Payload Example
  • Unit, Integration Tests
  • Documentation Updates (when adding/changing features)
  • Example Plugin Updates (when adding/changing features)
  • Outline Remaining Work, Constraints from Design

@jathanism
Enforce sandboxed rendering for Jinja2 templates.
d47f157 
- This forces the Jinja2 template renderer to use a `SandboxedEnvironment`
- This addresses any unsafe code execution everywhere `render_jinja2` is called.
- Test added to assert that unsafe attributes cannot be accessed and will result in a `SecurityError`.
- Documentation referencing direct use of `jinja2.Template` replaced with `render_jinja2`
@jathanism
Added changelog file.
b5eebd0
@jathanism jathanism force-pushed the jathanism-jinja-sandboxed-render branch from 85d8c60 to b5eebd0 Compare January 4, 2023 18:21
HanlinMiao
HanlinMiao approved these changes Jan 4, 2023
View reviewed changes
Copy link
Contributor

@HanlinMiao HanlinMiao left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks good except for the comment I made

changes/3074.security Outdated Show resolved Hide resolved
@jathanism jathanism self-assigned this Jan 4, 2023
@jathanism jathanism merged commit 14ec554 into nautobot:develop Jan 4, 2023
@jathanism jathanism deleted the jathanism-jinja-sandboxed-render branch January 4, 2023 20:38
This was referenced Jan 4, 2023
Merged
Closed
@bryanculver bryanculver linked an issue Jan 16, 2023 that may be closed by this pull request
Security Disclosure: Jinja2 Template Sandboxing #3093
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@HanlinMiao HanlinMiao HanlinMiao approved these changes

@glennmatthews glennmatthews glennmatthews approved these changes

Assignees

@jathanism jathanism

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Security Disclosure: Jinja2 Template Sandboxing
3 participants
@jathanism @glennmatthews @HanlinMiao