From d4aa8ee09e2d6e6676ed2dd7144d541e359fef7e Mon Sep 17 00:00:00 2001 From: Michal Nasiadka Date: Wed, 10 Jun 2026 17:27:50 +0100 Subject: kolla-build: Use SandboxedEnvironment to prevent SSTI Switch from jinja2.Environment to jinja2.sandbox.SandboxedEnvironment to block Server-Side Template Injection attacks. Closes-Bug: #2146056 Change-Id: Iecd1d8dcf99007e3339120961c7c1d0ca12f83d8 Signed-off-by: Michal Nasiadka (cherry picked from commit 0b20ffce09552014fa52c45de574511dc2200ac5) --- tools/validate-all-file.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'tools/validate-all-file.py') diff --git a/tools/validate-all-file.py b/tools/validate-all-file.py index 67f03218a..12a50a70c 100755 --- a/tools/validate-all-file.py +++ b/tools/validate-all-file.py @@ -21,6 +21,7 @@ import re import sys import jinja2 +import jinja2.sandbox PROJECT_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), '..')) @@ -75,7 +76,7 @@ def check_json_j2(): return collections.defaultdict(hostvars) def validate_json_j2(root, filename): - env = jinja2.Environment( # nosec: not used to render HTML + env = jinja2.sandbox.SandboxedEnvironment( loader=jinja2.FileSystemLoader(root)) env.filters['bool'] = bool_filter template = env.get_template(filename) -- cgit v1.2.3