Update dependency Jinja2 to v3 [SECURITY] #4
Conversation
Micro-Learning Topic: Race condition (Detected by phrase)Matched on "race condition"A race condition is a flaw that produces an unexpected result when the timing of actions impact other actions. Try a challenge in Secure Code WarriorMicro-Learning Topic: SQL injection (Detected by phrase)Matched on "sqli"This is probably one of the two most exploited vulnerabilities in web applications and has led to a number of high profile company breaches. It occurs when an application fails to sanitize or validate input before using it to dynamically construct a statement. An attacker that exploits this vulnerability will be able to gain access to the underlying database and view or modify data without permission. Try a challenge in Secure Code WarriorHelpful references
Micro-Learning Topic: Cross-site scripting (Detected by phrase)Matched on "XSS"Cross-site scripting vulnerabilities occur when unescaped input is rendered into a page displayed to the user. When HTML or script is included in the input, it will be processed by a user's browser as HTML or script and can alter the appearance of the page or execute malicious scripts in their user context. Try a challenge in Secure Code WarriorHelpful references
|
renovate
bot
force-pushed
the
renovate/pypi-jinja2-vulnerability
branch
from
e307250 to
990f353
Compare
🔐 Secure Code Review (AI)No eligible code changes. Models can make mistakes. Verify before merging. |
renovate
bot
force-pushed
the
renovate/pypi-jinja2-vulnerability
branch
12 times, most recently
from
e0f1f4c to
4ab0886
Compare
renovate
bot
force-pushed
the
renovate/pypi-jinja2-vulnerability
branch
from
4ab0886 to
6dc0fea
Compare
|
This PR contains the following updates:
==2.10->==3.1.6GitHub Vulnerability Alerts
CVE-2019-10906
In Pallets Jinja before 2.10.1,
str.format_mapallows a sandbox escape.The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the
str.format_mapmethod could be used to escape the sandbox.This issue was previously addressed for the
str.formatmethod in Jinja 2.8.1, which discusses the issue in detail. However, the less-commonstr.format_mapmethod was overlooked. This release applies the same sandboxing to both methods.If you cannot upgrade Jinja, you can override the
is_safe_attributemethod on the sandbox and explicitly disallow theformat_mapmethod on string objects.CVE-2020-28493
This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern [a-zA-Z0-9.-]+.[a-zA-Z0-9.-]+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.
CVE-2024-22195
The
xmlattrfilter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of thexmlattrfilter, and an application doing so should already be verifying what keys are provided regardless of this fix.CVE-2024-34064
The
xmlattrfilter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces,/,>, or=, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters.Accepting keys as user input is now explicitly considered an unintended use case of the
xmlattrfilter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting values as user input continues to be safe.CVE-2024-56326
An oversight in how the Jinja sandboxed environment detects calls to
str.formatallows an attacker that controls the content of a template to execute arbitrary Python code.To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.
Jinja's sandbox does catch calls to
str.formatand ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string'sformatmethod, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.CVE-2025-27516
An oversight in how the Jinja sandboxed environment interacts with the
|attrfilter allows an attacker that controls the content of a template to execute arbitrary Python code.To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.
Jinja's sandbox does catch calls to
str.formatand ensures they don't escape the sandbox. However, it's possible to use the|attrfilter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the|attrfilter no longer bypasses the environment's attribute lookup.Release Notes
pallets/jinja (Jinja2)
v3.1.6Compare Source
Released 2025-03-05
|attrfilter does not bypass the environment's attribute lookup,allowing the sandbox to apply its checks. :ghsa:
cpwx-vrp4-4pq7v3.1.5Compare Source
Released 2024-12-21
str.format, such asby passing a stored reference to a filter that calls its argument.
:ghsa:
q2x7-8rv6-6q7hissues with names that contain f-string syntax.
:issue:
1792, :ghsa:gmj6-6f8f-6699clearandpopon known mutable sequencetypes. :issue:
2032renderfor an async template usesasyncio.run.:pr:
1952auto_aiterwarnings. :pr:1960aclose-ableAsyncGeneratorfromTemplate.generate_async. :pr:1960root_render_func()unclosed inTemplate.generate_async. :pr:1960:pr:
1960concatfunction for the current environmentwhen calling block references. :issue:
1701|uniqueasync-aware, allowing it to be used after anotherasync-aware filter. :issue:
1781|intfilter handlesOverflowErrorfrom scientific notation.:issue:
1921{% set ... %}call. :issue:
2021copy/pickle/etc) interaction withUndefinedobjects. :issue:
2025copy/picklesupport for the internalmissingobject.:issue:
2027Environment.overlay(enable_async)is applied correctly. :pr:2061FileSystemLoaderincludes the paths that weresearched. :issue:
1661PackageLoadershows a clearer error message when the package does notcontain the templates directory. :issue:
17051880urlizedoes not addmailto:to values like@a@b. :pr:1870@pass_context`` can be used with the ``|select`` filter. :issue:1624`setfor multiple assignment (a, b = 1, 2) does not fail when thetarget is a namespace attribute. :issue:
1413setin all branches of{% if %}{% elif %}{% else %}blocksdoes not cause the variable to be considered initially undefined.
:issue:
1253v3.1.4Compare Source
Released 2024-05-05
xmlattrfilter does not allow keys with/solidus,>greater-than sign, or
=equals sign, in addition to disallowing spaces.Regardless of any validation done by Jinja, user input should never be used
as keys to this filter, or must be separately validated first.
:ghsa:
h75v-3vvj-5mfjv3.1.3Compare Source
Released 2024-01-10
empty. :pr:
1858xmlattrfilter does not allow keys with spaces. :ghsa:h5c8-rqwp-cp95{% trans %}blocksmore helpful. :pr:
1918v3.1.2Compare Source
Released 2022-04-28
Environment.overlayto match__init__.:issue:
1645FileSystemBytecodeCache. :issue:1654v3.1.1Compare Source
Released 2022-03-25
:issue:
1637v3.1.0Compare Source
Released 2022-03-24
Drop support for Python 3.6. :pr:
1534Remove previously deprecated code. :pr:
1544WithExtensionandAutoEscapeExtensionare built-in now.contextfilterandcontextfunctionare replaced bypass_context.evalcontextfilterandevalcontextfunctionare replaced bypass_eval_context.environmentfilterandenvironmentfunctionare replacedby
pass_environment.Markupandescapeshould be imported from MarkupSafe.recompiled.
Contextsubclasses is no longersupported. Override
resolve_or_missinginstead ofresolve.unicode_urlencodeis renamed tourl_quote.Add support for native types in macros. :issue:
1510The
{% trans %}tag can usepgettextandnpgettextbypassing a context string as the first token in the tag, like
{% trans "title" %}. :issue:1430Update valid identifier characters from Python 3.6 to 3.7.
:pr:
1571Filters and tests decorated with
@async_variantare pickleable.:pr:
1612Add
itemsfilter. :issue:1561Subscriptions (
[0], etc.) can be used after filters, tests, andcalls when the environment is in async mode. :issue:
1573The
groupbyfilter is case-insensitive by default, matchingother comparison filters. Added the
case_sensitiveparameter tocontrol this. :issue:
1463Windows drive-relative path segments in template names will not
result in
FileSystemLoaderandPackageLoaderloading fromdrive-relative paths. :pr:
1621v3.0.3Compare Source
Released 2021-11-09
:issue:
1535when parsing values on Python 3.10. :pr:
1537:issue:
1514hash(Node)behavior. Nodes are hashed by idagain :issue:
1521PackageLoaderworks when the package is a single module file.:issue:
1512v3.0.2Compare Source
Released 2021-10-04
to still be referenced outside of it. :issue:
1427compile_templatesdeterministic for filter and importnames. :issue:
1452, 1453Undefinedto act likeStrictUndefinedfor theinoperator. :issue:1448environments. :issue:
1494PackageLoaderwill not include a current directory (.) pathsegment. This allows loading templates from the root of a zip
import. :issue:
1467v3.0.1Compare Source
Released 2021-05-18
1418imports in user projects. :issue:
14261433autoescapeandwith_extensions shows more relevant context. :issue:
1429jinja2.Markupwithout an argument.Use
markupsafe.Markupinstead. :issue:1438renderfor an async template usesasyncio.new_event_loopThis fixes a deprecation that Python 3.10 introduces. :issue:
1443v3.0.0Compare Source
Released 2021-05-11
Drop support for Python 2.7 and 3.5.
Bump MarkupSafe dependency to >=1.1.
Bump Babel optional dependency to >=2.1.
Remove code that was marked deprecated.
Add type hinting. :pr:
1412Use :pep:
451API to load templates with:class:
~loaders.PackageLoader. :issue:1168Fix a bug that caused imported macros to not have access to the
current template's globals. :issue:
688Add ability to ignore
trim_blocksusing+%}. :issue:1036Fix a bug that caused custom async-only filters to fail with
constant input. :issue:
1279Fix UndefinedError incorrectly being thrown on an undefined variable
instead of
Undefinedbeing returned onNativeEnvironmenton Python 3.10. :issue:1335Blocks can be marked as
required. They must be overridden atsome point, but not necessarily by the direct child. :issue:
1147Deprecate the
autoescapeandwithextensions, they arebuilt-in to the compiler. :issue:
1203The
urlizefilter recognizesmailto:links and takesextra_schemes(orenv.policies["urlize.extra_schemes"]) torecognize other schemes. It tries to balance parentheses within a
URL instead of ignoring trailing characters. The parsing in general
has been updated to be more efficient and match more cases. URLs
without a scheme are linked as
https://instead ofhttp://.:issue:
522, 827, 1172, :pr:1195Filters that get attributes, such as
mapandgroupby, canuse a false or empty value as a default. :issue:
1331Fix a bug that prevented variables set in blocks or loops from
being accessed in custom context functions. :issue:
768Fix a bug that caused scoped blocks from accessing special loop
variables. :issue:
1088Update the template globals when calling
Environment.get_template(globals=...)even if the template wasalready loaded. :issue:
295Do not raise an error for undefined filters in unexecuted
if-statements and conditional expressions. :issue:
842Add
is filterandis testtests to test if a name is aregistered filter or test. This allows checking if a filter is
available in a template before using it. Test functions can be
decorated with
@pass_environment,@pass_eval_context,or
@pass_context. :issue:842, :pr:1248Support
pgettextandnpgettext(message contexts) in i18nextension. :issue:
441The
|indentfilter'swidthargument can be a string toindent by. :pr:
1167The parser understands hex, octal, and binary integer literals.
:issue:
1170Undefined.__contains__(in) raises anUndefinedErrorinstead of a
TypeError. :issue:1198Undefinedis iterable in an async environment. :issue:1294NativeEnvironmentsupports async mode. :issue:1362Template rendering only treats
\n,\r\nand\ras linebreaks. Other characters are left unchanged. :issue:
769, 952, 1313|groupbyfilter takes an optionaldefaultargument.:issue:
1359The function and filter decorators have been renamed and unified.
The old names are deprecated. :issue:
1381pass_contextreplacescontextfunctionandcontextfilter.pass_eval_contextreplacesevalcontextfunctionandevalcontextfilterpass_environmentreplacesenvironmentfunctionandenvironmentfilter.Async support no longer requires Jinja to patch itself. It must
still be enabled with
Environment(enable_async=True).:issue:
1390Overriding
Context.resolveis deprecated, overrideresolve_or_missinginstead. :issue:1380v2.11.3Compare Source
Released 2021-01-31
urlizefilter by reducing regexbacktracking. Email matching requires a word character at the start
of the domain part, and only word characters in the TLD. :pr:
1343v2.11.2Compare Source
Released 2020-04-13
__getattr__, like:class:
~unittest.mock.Mockto be treated as a:func:
contextfunction. :issue:1145wordcountfilter to trigger :class:Undefinedmethodsby wrapping the input in :func:
soft_str. :pr:1160:issue:
1162AttributeErroron access doesn't cause a recursion error.:issue:
1177~loaders.PackageLoaderfrom 2.10 whichremoved the dependency on setuptools and pkg_resources, and added
limited support for namespace packages. The changes caused issues
when using Pytest. Due to the difficulty in supporting Python 2 and
:pep:
451simultaneously, the changes are reverted until 3.0.:pr:
1182:pr:
1178namespace()assignment object in templates works inasync environments. :issue:
1180lstrip_blocksis enabled. :issue:1138~nativetypes.NativeEnvironmentdoesn't evaluateintermediate strings during rendering. This prevents early
evaluation which could change the value of an expression.
:issue:
1186v2.11.1Compare Source
Released 2020-01-30
(
{{ data.items[1:] }}) in an async template. :issue:1141v2.11.0Compare Source
Released 2020-01-27
version to support Python 2.7 and 3.5.
ChainableUndefinedclass to support getitem andgetattr on an undefined object. :issue:
977{%+syntax (with NOP behavior) whenlstrip_blocksisdisabled. :issue:
748defaultparameter for themapfilter. :issue:557:func:
meta.find_undeclared_variables. :issue:9312.56e-3. :issue:
912, :pr:922legibility, like 12_345. :pr:
923LRUCache.setdefault. :pr:1000trimfilter takes an optional string of characters to trim.:pr:
828jinja2.ext.debugextension adds a{% debug %}tag toquickly dump the current context and available filters and tests.
:issue:
174, :pr:798, 983:issue:
857, :pr:858{{ 2 * (3 < 5) }}outputs "2" instead of "False".:issue:
755, :pr:938boolean,false,true,integerandfloattests. :pr:
824finalizefunction is only applied to theoutput of expressions (constant or not), not static template data.
:issue:
63FileSystemLoader, a templatecan have the same name as a directory. :issue:
821Undefinedwhen omitting theelseclausein a
{{ 'foo' if bar }}expression, regardless of theenvironment's
undefinedclass. Omitting theelseclause is avalid shortcut and should not raise an error when using
:class:
StrictUndefined. :issue:710, :pr:1079loopcontrol variables such aslengthandrevindex0when looping over a generator. :issue:459, 751, 794,:pr:
993it, in order to avoid a slow initial import. :issue:
765|mapfilter will await the filtercall if needed. :pr:
913loopattributes, the iterator is notadvanced ahead of the current iteration unless
length,revindex,nextitem, orlastare accessed. This makes itless likely to break
groupbyresults. :issue:555, :pr:1101loopattributeslengthandrevindexwork for async iterators. :pr:1101be awaited if needed. :pr:
1101~loader.PackageLoaderdoesn't depend on setuptools orpkg_resources. :issue:
970PackageLoaderhas limited support for :pep:420namespacepackages. :issue:
1097os.PathLikeobjects in:class:
~loader.FileSystemLoaderand :class:~loader.ModuleLoader.:issue:
870~nativetypes.NativeTemplatecorrectly handles quotesbetween expressions.
"'{{ a }}', '{{ b }}'"renders as the tuple('1', '2')rather than the string'1, 2'. :issue:1020~nativetypes.NativeTemplatedirectly creates a:class:
~nativetypes.NativeEnvironmentinstead of a default:class:
Environment. :issue:1091LRUCache.copy(), the copy's queue methods point tothe correct queue. :issue:
843system encoding. :issue:
889|wordwrapfilter treats existing newlines as separate paragraphsto be wrapped individually, rather than creating short intermediate
lines. :issue:
175break_on_hyphensparameter to|wordwrapfilter.:issue:
550passed the context. :pr:
1108the result follows Python's behavior of returning
Falseif anycomparison returns
False, rather than only the last one.:issue:
1102and source for Python >= 3.7. :issue:
1104internal compiler frames. :issue:
763DerivedContextReferencenode that can be used byextensions to get the current context and local variables such as
loop. :issue:860that were previously overlooked. :issue:
733TemplateSyntaxError.sourceis not empty when raised from anincluded template. :issue:
457Undefinedvalue toget_template(such as throughextends,import, orinclude), raises anUndefinedErrorconsistently.select_templatewill show theundefined message in the list of attempts rather than the empty
string. :issue:
1037TemplateSyntaxErrorcan be pickled. :pr:1117v2.10.3Compare Source
Released 2019-10-04
setup.pythat was preventinginstallation.
v2.10.2Compare Source
Released 2019-10-04
rangein the sandboxed environment usesxrangeonPython 2 to avoid memory use. :issue:
933using debug builds of Python 3.7. :issue:
1050v2.10.1Compare Source
Released 2019-04-06
SandboxedEnvironmentsecurely handlesstr.format_mapinorder to prevent code execution through untrusted format strings.
The sandbox already handled
str.format.Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.