I am using Jinja2 as my templating engine for an admin dashboard, that displays some user feedback. I worry that an attacker could type some python code as their feedback and the Jinja2 template could execute that.
I.e.
An attacker might put the following as their feedback:
__import__('subprocess').getoutput('tree')
When the templater renders this, i.e.
feedback = "__import__('subprocess').getoutput('tree')"
Template("{{ feedback }}").render(feedback=feedback)
The tree command is run in the terminal.
How can I sanitise my strings so that they do not include any python code which might allow them access to my server via the command line?
{characters in the user-supplied string. Maybe jinja2 has some escape function to do it better.{{ feedback }}in your code is already safe and correct: Python commands within the feedback string variable won't be executed.{{ feedback | safe }}, your ... well, safe: jinja.palletsprojects.com/en/3.1.x/templates/…