Use Jinja sandboxed environment
@@ -88,9 +88,10 @@ def get_jinja_environment(allow_undefined=False, trim_blocks=True, lstrip_blocks
# Late import to avoid very expensive in-direct import (~1 second) when this function
# is not called / used
import jinja2
+ import jinja2.sandbox
undefined = jinja2.Undefined if allow_undefined else jinja2.StrictUndefined
- env = jinja2.Environment( # nosec
+ env = jinja2.sandbox.SandboxedEnvironment( # nosec
undefined=undefined, trim_blocks=trim_blocks, lstrip_blocks=lstrip_blocks
)
env.filters.update(get_filters())
