File tree Expand file tree Collapse file tree 2 files changed +14
-2
lines changed Expand file tree Collapse file tree 2 files changed +14
-2
lines changed Original file line number Diff line number Diff line change 11
11
12
12
import jinja2
13
13
import jinja2 .ext
14
+ import jinja2 .sandbox
14
15
import salt .utils .data
15
16
import salt .utils .dateutils
16
17
import salt .utils .files
@@ -453,9 +454,11 @@ def opt_jinja_env_helper(opts, optname):
453
454
opt_jinja_env_helper (opt_jinja_env , "jinja_env" )
454
455
455
456
if opts .get ("allow_undefined" , False ):
456
- jinja_env = jinja2 .Environment (** env_args )
457
+ jinja_env = jinja2 .sandbox . SandboxedEnvironment (** env_args )
457
458
else :
458
- jinja_env = jinja2 .Environment (undefined = jinja2 .StrictUndefined , ** env_args )
459
+ jinja_env = jinja2 .sandbox .SandboxedEnvironment (
460
+ undefined = jinja2 .StrictUndefined , ** env_args
461
+ )
459
462
460
463
tojson_filter = jinja_env .filters .get ("tojson" )
461
464
indent_filter = jinja_env .filters .get ("indent" )
@@ -506,6 +509,7 @@ def opt_jinja_env_helper(opts, optname):
506
509
except (
507
510
jinja2 .exceptions .TemplateRuntimeError ,
508
511
jinja2 .exceptions .TemplateSyntaxError ,
512
+ jinja2 .exceptions .SecurityError ,
509
513
) as exc :
510
514
trace = traceback .extract_tb (sys .exc_info ()[2 ])
511
515
line , out = _get_jinja_error (trace , context = decoded_context )
Original file line number Diff line number Diff line change 7
7
import sys
8
8
from pathlib import PurePath , PurePosixPath
9
9
10
+ import pytest
10
11
import salt .utils .files
11
12
import salt .utils .templates
12
13
from tests .support import mock
@@ -201,6 +202,13 @@ def test_render_cheetah_variable(self):
201
202
res = salt .utils .templates .render_cheetah_tmpl (tmpl , ctx )
202
203
self .assertEqual (res .strip (), "OK" )
203
204
205
+ def test_render_jinja_cve_2021_25283 (self ):
206
+ tmpl = """{{ [].__class__ }}"""
207
+ ctx = dict (self .context )
208
+ ctx ["var" ] = "OK"
209
+ with pytest .raises (salt .exceptions .SaltRenderError ):
210
+ res = salt .utils .templates .render_jinja_tmpl (tmpl , ctx )
211
+
204
212
205
213
class MockRender :
206
214
def __call__ (self , tplstr , context , tmplpath = None ):
You can’t perform that action at this time.
0 commit comments