Template injection (ARCH2130)

Key python.security.template-injection · Severity error · Category security · CWE CWE-1336

Building the template string itself from untrusted input leads to server-side template injection (SSTI) and remote code execution. Pass input only as data.

Incorrect

from jinja2 import Template
from flask import request

def render():
    return Template("Hello " + request.args["name"]).render()

Correct

from jinja2 import Template
from flask import request

def render():
    return Template("Hello {{ name }}").render(name=request.args["name"])

Fix

Keep the template constant and pass user input only as data in the render context.