Jinja2 is the template engine behind Flask and many Python frameworks. Template(source).render() and Environment.from_string() evaluate template syntax — SSTI sink when the template source comes from user input. Autoescape only protects rendered output, not the template source itself.
.Template().Environment.from_string().Template()Sinkjinja2.Template(source: str, ...) -> Template
Compiles a template from source. SSTI sink when source is user-controlled.
0.Environment.from_string()SinkEnvironment.from_string(source: str, ...) -> Template
Compiles a template from source using this environment. Same SSTI risk.
0.render()NeutralTemplate.render(**context) -> str
Renders a compiled template. Safe with autoescape=True on trusted templates; dangerous if the Template source itself was user-controlled.
| FQN | Field | |
|---|---|---|
| jinja2 | fqns[0] | |
| jinja2.Template | fqns[1] | |
| jinja2.Environment | fqns[2] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PyJinja2