diff options
| author | Zuul <zuul@review.opendev.org> | 2026-06-11 13:15:44 +0000 |
|---|---|---|
| committer | Gerrit Code Review <review@openstack.org> | 2026-06-11 13:15:44 +0000 |
| commit | 2324981a588ef0ec6a7de7227d297a9d0faf08e9 (patch) | |
| tree | 3fa0bfb0558afdcfc2323fccca9cdd9a267df4fa /tools | |
| parent | 12bd811060938d87cf77ea0fa20f161f61916958 (diff) | |
| parent | 0b20ffce09552014fa52c45de574511dc2200ac5 (diff) | |
| download | kolla-2324981a588ef0ec6a7de7227d297a9d0faf08e9.tar.gz kolla-2324981a588ef0ec6a7de7227d297a9d0faf08e9.zip | |
Merge "kolla-build: Use SandboxedEnvironment to prevent SSTI"
Diffstat (limited to 'tools')
| -rwxr-xr-x | tools/validate-all-file.py | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/tools/validate-all-file.py b/tools/validate-all-file.py index 67f03218a..12a50a70c 100755 --- a/tools/validate-all-file.py +++ b/tools/validate-all-file.py @@ -21,6 +21,7 @@ import re import sys import jinja2 +import jinja2.sandbox PROJECT_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), '..')) @@ -75,7 +76,7 @@ def check_json_j2(): return collections.defaultdict(hostvars) def validate_json_j2(root, filename): - env = jinja2.Environment( # nosec: not used to render HTML + env = jinja2.sandbox.SandboxedEnvironment( loader=jinja2.FileSystemLoader(root)) env.filters['bool'] = bool_filter template = env.get_template(filename) |