Patched code sample

import jinja2
import signal
from contextlib import contextmanager

# The vulnerability is that Jinja2's SandboxedEnvironment does not limit
# the execution time or computational complexity of the expressions it renders.
# An attacker can submit a template that performs a very long calculation,
# causing a Denial of Service (DoS) by consuming 100% CPU.

# The fix is to wrap the template rendering process in a timeout, which
# aborts the operation if it takes too long. This example uses Python's
# built-in signal library to achieve this.

EXECUTION_TIMEOUT_SECONDS = 2

class TimeoutException(Exception):
    """Custom exception to be raised on timeout."""
    pass

@contextmanager
def time_limit(seconds):
    """
    A context manager to enforce a time limit on a block of code.
    Raises TimeoutException if the code does not complete in time.
    NOTE: This is a Unix-specific solution using signals.
    """
    def signal_handler(signum, frame):
        raise TimeoutException(f"Timed out after {seconds} seconds.")

    # Set the signal handler for the alarm signal (SIGALRM)
    original_handler = signal.signal(signal.SIGALRM, signal_handler)
    
    try:
        # Schedule the alarm
        signal.alarm(seconds)
        yield
    finally:
        # Cancel the alarm and restore the original signal handler
        signal.alarm(0)
        signal.signal(signal.SIGALRM, original_handler)

def render_template_safely(template_string: str, data: dict) -> str:
    """
    Renders a Jinja2 template within a strict time limit to prevent DoS.
    """
    env = jinja2.SandboxedEnvironment()
    
    try:
        # Use the time_limit context manager to enforce the timeout
        with time_limit(EXECUTION_TIMEOUT_SECONDS):
            template = env.from_string(template_string)
            return template.render(data)
    except TimeoutException as e:
        # The rendering took too long and was aborted.
        return f"Error: Rendering aborted. {e}"
    except Exception as e:
        # Catch other potential Jinja2 or rendering errors
        return f"Error: An unexpected error occurred during rendering: {e}"

if __name__ == "__main__":
    # Example 1: Benign template that runs quickly
    benign_template = "Hello, {{ name }}! Your lucky number is {{ 5*5 }}."
    benign_data = {"name": "World"}
    print("--- Testing benign template ---")
    result = render_template_safely(benign_template, benign_data)
    print(f"Result: {result}\n")

    # Example 2: Malicious template designed to cause a long-running calculation
    # This attempts to create a huge list, consuming CPU time.
    malicious_template = """
    {% set _ = [] %}
    {% for i in range(10**8) %}
      {% set _ = _.append(i) %}
    {% endfor %}
    This will never be seen.
    """
    print("--- Testing malicious DoS template ---")
    result = render_template_safely(malicious_template, {})
    print(f"Result: {result}")
    print("DoS attack was successfully prevented by the timeout.")