jinja2.sandbox Namespace Reference

Classes
class	ImmutableSandboxedEnvironment
class	SandboxedEnvironment
class	SandboxedEscapeFormatter
class	SandboxedFormatter

Functions
range	safe_range (*int args)
F	unsafe (F f)
bool	is_internal_attribute (t.Any obj, str attr)
bool	modifies_known_mutable (t.Any obj, str attr)

Variables
	F = t.TypeVar("F", bound=t.Callable[..., t.Any])
int	MAX_RANGE = 100000
t	UNSAFE_FUNCTION_ATTRIBUTES = set()
t	UNSAFE_METHOD_ATTRIBUTES = set()
dict	UNSAFE_GENERATOR_ATTRIBUTES = {"gi_frame", "gi_code"}
dict	UNSAFE_COROUTINE_ATTRIBUTES = {"cr_frame", "cr_code"}
dict	UNSAFE_ASYNC_GENERATOR_ATTRIBUTES = {"ag_code", "ag_frame"}
tuple	_mutable_spec

Detailed Description

A sandbox layer that ensures unsafe operations cannot be performed.
Useful when the template itself comes from an untrusted source.

Function Documentation

is_internal_attribute()

bool jinja2.sandbox.is_internal_attribute	(	t.Any	obj,
		str	attr
	)

Test if the attribute given is an internal python attribute.  For
example this function returns `True` for the `func_code` attribute of
python objects.  This is useful if the environment method
:meth:`~SandboxedEnvironment.is_safe_attribute` is overridden.

>>> from jinja2.sandbox import is_internal_attribute
>>> is_internal_attribute(str, "mro")
True
>>> is_internal_attribute(str, "upper")
False

modifies_known_mutable()

bool jinja2.sandbox.modifies_known_mutable	(	t.Any	obj,
		str	attr
	)

This function checks if an attribute on a builtin mutable object
(list, dict, set or deque) or the corresponding ABCs would modify it
if called.

>>> modifies_known_mutable({}, "clear")
True
>>> modifies_known_mutable({}, "keys")
False
>>> modifies_known_mutable([], "append")
True
>>> modifies_known_mutable([], "index")
False

If called with an unsupported object, ``False`` is returned.

>>> modifies_known_mutable("foo", "upper")
False

safe_range()

range jinja2.sandbox.safe_range

(

*int

args

)

A range that can't generate ranges with a length of more than
MAX_RANGE items.

unsafe()

F jinja2.sandbox.unsafe

(

F

f

)

Marks a function or method as unsafe.

.. code-block: python

    @unsafe
    def delete(self):
        pass