def test_unsafe(self):
env = SandboxedEnvironment()
self.assert_raises(SecurityError, env.from_string("{{ foo.foo() }}").render, foo=PrivateStuff())
self.assert_equal(env.from_string("{{ foo.bar() }}").render(foo=PrivateStuff()), "23")
self.assert_raises(SecurityError, env.from_string("{{ foo._foo() }}").render, foo=PublicStuff())
self.assert_equal(env.from_string("{{ foo.bar() }}").render(foo=PublicStuff()), "23")
self.assert_equal(env.from_string("{{ foo.__class__ }}").render(foo=42), "")
self.assert_equal(env.from_string("{{ foo.func_code }}").render(foo=lambda: None), "")
self.assert_raises(SecurityError, env.from_string("{{ foo.__class__.__subclasses__() }}").render, foo=42)
def test_item_and_attribute(self):
from ambari_jinja2.sandbox import SandboxedEnvironment
for env in Environment(), SandboxedEnvironment():
# the |list is necessary for python3
tmpl = env.from_string('{{ foo.items()|list }}')
assert tmpl.render(foo={'items': 42}) == "[('items', 42)]"
tmpl = env.from_string('{{ foo|attr("items")()|list }}')
assert tmpl.render(foo={'items': 42}) == "[('items', 42)]"
tmpl = env.from_string('{{ foo["items"] }}')
assert tmpl.render(foo={'items': 42}) == '42'
def test_unsafe(self):
env = SandboxedEnvironment()
self.assert_raises(SecurityError,
env.from_string("{{ foo.foo() }}").render,
foo=PrivateStuff())
self.assert_equal(
env.from_string("{{ foo.bar() }}").render(foo=PrivateStuff()),
'23')
self.assert_raises(SecurityError,
env.from_string("{{ foo._foo() }}").render,
foo=PublicStuff())
self.assert_equal(
env.from_string("{{ foo.bar() }}").render(foo=PublicStuff()), '23')
self.assert_equal(
env.from_string("{{ foo.__class__ }}").render(foo=42), '')
self.assert_equal(
env.from_string("{{ foo.func_code }}").render(foo=lambda: None),
'')
self.assert_raises(
SecurityError,
env.from_string("{{ foo.__class__.__subclasses__() }}").render,
foo=42)
def test_attr_filter(self):
env = SandboxedEnvironment()
tmpl = env.from_string('{{ 42|attr("__class__")|attr("__subclasses__")() }}')
self.assert_raises(SecurityError, tmpl.render)
def test_restricted(self):
env = SandboxedEnvironment()
self.assert_raises(TemplateSyntaxError, env.from_string,
"{% for item.attribute in seq %}...{% endfor %}")
self.assert_raises(TemplateSyntaxError, env.from_string,
"{% for foo, bar.baz in seq %}...{% endfor %}")
def test_attr_filter(self):
env = SandboxedEnvironment()
tmpl = env.from_string(
'{{ 42|attr("__class__")|attr("__subclasses__")() }}')
self.assert_raises(SecurityError, tmpl.render)