Patched code sample

import jinja2
from jinja2.sandbox import SandboxedEnvironment

# The CVE is fictional (year 2026), but it describes a real-world SSTI vulnerability
# pattern. The following code represents the fix for such a vulnerability.
# The vulnerability exists because user-provided template strings are rendered in an
# unsandboxed Jinja2 environment, allowing access to the underlying Python environment.
#
# The fix is to use jinja2.sandbox.SandboxedEnvironment, which restricts the template's
# access to potentially unsafe attributes and functions.

def fixed_template_render(user_supplied_template: str, context: dict) -> str:
    """
    Renders a user-supplied template string using a sandboxed Jinja2 environment
    to prevent Server-Side Template Injection (SSTI).

    Args:
        user_supplied_template: The template string provided by a user.
        context: A dictionary of variables to be made available in the template.

    Returns:
        The rendered string, or an error message if the template attempts
        to perform an unsafe operation.
    """
    # 1. Create a SandboxedEnvironment. This is the crucial step in the fix.
    #    This environment prevents templates from accessing unsafe attributes
    #    like .__class__, .__globals__, etc.
    sandboxed_env = SandboxedEnvironment()

    try:
        # 2. Load the user-provided template string into the sandboxed environment.
        template = sandboxed_env.from_string(user_supplied_template)

        # 3. Render the template with the provided context.
        rendered_output = template.render(context)
        return rendered_output

    except (jinja2.exceptions.SecurityError, TypeError, Exception) as e:
        # 4. If the template tries to access a forbidden attribute or function,
        #    the SandboxedEnvironment will raise a SecurityError or other exception.
        #    We catch this to prevent the application from crashing and can return
        #    a safe error message.
        error_message = f"Blocked unsafe template operation: {e}"
        # In a real application, this should be logged for security monitoring.
        print(error_message)
        return "Error: The provided template contains disallowed operations."


# --- Demonstration ---
if __name__ == '__main__':
    # A normal, safe template provided by a user
    safe_template = "Hello, {{ user_name }}! Welcome."

    # A malicious template attempting to execute OS commands (SSTI payload)
    # This payload tries to import the 'os' module and run the 'id' command.
    malicious_template = "Hello, {{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}"

    # The context data to be rendered in the template
    render_context = {"user_name": "Alex"}

    print("--- Testing the FIXED Rendering Function ---")

    # 1. Test with the safe template
    print(f"\nRendering safe template: '{safe_template}'")
    safe_result = fixed_template_render(safe_template, render_context)
    print(f"Result: {safe_result}")
    assert "Hello, Alex! Welcome." in safe_result

    print("-" * 40)

    # 2. Test with the malicious template
    print(f"\nRendering malicious template: '{malicious_template}'")
    malicious_result = fixed_template_render(malicious_template, render_context)
    print(f"Result: {malicious_result}")
    assert "disallowed" in malicious_result

    print("\nDemonstration complete. The malicious payload was successfully blocked by the sandbox.")