← Back to context Comment by ks2048 21 hours ago Why doesn't Jinja2 block ".__*" attribute access? 2 comments ks2048 Reply simonw 2 hours ago It does if you use "sandbox" mode, but that's not the default: https://jinja.palletsprojects.com/en/stable/sandbox/ pas 2 hours ago ehh, it's Python, it's mostly vibe-based.https://stackoverflow.com/a/32802486though there's sandbox: https://jinja.palletsprojects.com/en/stable/sandbox/it simply predates the "sanitize by default" mindset/convention that nowadays React (dangerouslySetInnerHTML) and Angular has.
simonw 2 hours ago It does if you use "sandbox" mode, but that's not the default: https://jinja.palletsprojects.com/en/stable/sandbox/
pas 2 hours ago ehh, it's Python, it's mostly vibe-based.https://stackoverflow.com/a/32802486though there's sandbox: https://jinja.palletsprojects.com/en/stable/sandbox/it simply predates the "sanitize by default" mindset/convention that nowadays React (dangerouslySetInnerHTML) and Angular has.
It does if you use "sandbox" mode, but that's not the default: https://jinja.palletsprojects.com/en/stable/sandbox/
ehh, it's Python, it's mostly vibe-based.
https://stackoverflow.com/a/32802486
though there's sandbox: https://jinja.palletsprojects.com/en/stable/sandbox/
it simply predates the "sanitize by default" mindset/convention that nowadays React (dangerouslySetInnerHTML) and Angular has.