2 ms·
Why doesn't Jinja2 block ".__*" attribute access?
by ks2048 3mo ago
Why doesn't Jinja2 block ".__*" attribute access?
- simonw 3mo agoIt does if you use "sandbox" mode, but that's not the default: https://jinja.palletsprojects.com/en/stable/sandbox/ https://jinja.palletsprojects.com/en/stable/sandbox/
- pas 3mo agoehh, it's Python, it's mostly vibe-based. https://stackoverflow.com/a/32802486 https://stackoverflow.com/a/32802486 though there's sandbox: https://jinja.palletsprojects.com/en/stable/sandbox/ https://jinja.palletsprojects.com/en/stable/sandbox/ it simply predates the "sanitize by default" mindset/convention that nowadays React (dangerouslySetInnerHTML) and Angular has.