def test_restricted(self, env):
env = SandboxedEnvironment()
pytest.raises(
TemplateSyntaxError,
env.from_string,
"{% for item.attribute in seq %}...{% endfor %}",
)
pytest.raises(
TemplateSyntaxError,
env.from_string,
"{% for foo, bar.baz in seq %}...{% endfor %}",
)
def test_unsafe(self, env):
env = SandboxedEnvironment()
pytest.raises(SecurityError,
env.from_string("{{ foo.foo() }}").render,
foo=PrivateStuff())
assert env.from_string("{{ foo.bar() }}").render(
foo=PrivateStuff()) == "23"
pytest.raises(SecurityError,
env.from_string("{{ foo._foo() }}").render,
foo=PublicStuff())
assert env.from_string("{{ foo.bar() }}").render(
foo=PublicStuff()) == "23"
assert env.from_string("{{ foo.__class__ }}").render(foo=42) == ""
assert env.from_string("{{ foo.func_code }}").render(
foo=lambda: None) == ""
# security error comes from __class__ already.
pytest.raises(
SecurityError,
env.from_string("{{ foo.__class__.__subclasses__() }}").render,
foo=42,
)
def test_unary_operator_intercepting(self, env):
def disable_op(arg):
raise TemplateRuntimeError("that operator so does not work")
for expr, ctx, rv in ("-1", {}, "-1"), ("-a", {"a": 2}, "-2"):
env = SandboxedEnvironment()
env.unop_table["-"] = disable_op
t = env.from_string("{{ %s }}" % expr)
assert t.render(ctx) == rv
env.intercepted_unops = frozenset(["-"])
t = env.from_string("{{ %s }}" % expr)
with pytest.raises(TemplateRuntimeError):
t.render(ctx)
def test_safe_format_all_okay(self):
env = SandboxedEnvironment()
t = env.from_string(
'{{ ("a{x.foo}b{y}"|safe).format_map({"x":{"foo": 42}, "y":"<foo>"}) }}'
)
assert t.render() == "a42b<foo>"
def test_basic_format_all_okay(self):
env = SandboxedEnvironment()
t = env.from_string('{{ "a{x.foo}b".format_map({"x":{"foo": 42}}) }}')
assert t.render() == "a42b"
def test_basic_format_safety(self):
env = SandboxedEnvironment()
t = env.from_string('{{ "a{x.__class__}b".format_map({"x":42}) }}')
assert t.render() == "ab"
def test_safe_format_safety(self):
env = SandboxedEnvironment()
t = env.from_string(
'{{ ("a{0.__class__}b{1}"|safe).format(42, "<foo>") }}')
assert t.render() == "ab<foo>"
def test_attr_filter(self, env):
env = SandboxedEnvironment()
tmpl = env.from_string('{{ cls|attr("__subclasses__")() }}')
pytest.raises(SecurityError, tmpl.render, cls=int)