logoalt Hacker News

ks2048 • yesterday at 1:33 AM • 2 replies • view on HN

Why doesn't Jinja2 block ".__*" attribute access?

Replies

simonw • yesterday at 8:28 PM

It does if you use "sandbox" mode, but that's not the default: https://jinja.palletsprojects.com/en/stable/sandbox/

pas • yesterday at 8:33 PM

ehh, it's Python, it's mostly vibe-based.

https://stackoverflow.com/a/32802486

though there's sandbox: https://jinja.palletsprojects.com/en/stable/sandbox/

it simply predates the "sanitize by default" mindset/convention that nowadays React (dangerouslySetInnerHTML) and Angular has.