Server Side Template Injection (SSTI)

// Python/Flask + Jinja2 - Secure template handling

from flask import Flask, request, render_template
from jinja2.sandbox import SandboxedEnvironment

app = Flask(__name__)

# SECURE: Predefined template allowlist - never compile user input!
TEMPLATE_MAP = {
    'welcome': 'templates/welcome.html',
    'notification': 'templates/notification.html',
    'report': 'templates/report.html'
}

@app.route('/api/preview', methods=['POST'])
def preview_template():
    # SECURE: User selects template by key, not content
    template_key = request.json.get('template_key', '')
    
    # SECURE: Validate against allowlist
    if template_key not in TEMPLATE_MAP:
        return {'error': 'Invalid template'}, 400
    
    # SECURE: Use render_template with fixed file path
    # This loads from filesystem, not user input!
    template_path = TEMPLATE_MAP[template_key]
    
    # SECURE: Minimal context - only provide necessary data
    context = {
        'username': 'demo',
        'date': '2024-01-15'
        # No access to config, globals, or dangerous objects
    }
    
    result = render_template(template_path, **context)
    return {'rendered': result}

# SECURE: If you must render dynamic content, use sandboxed environment
from jinja2 import Environment
from jinja2.sandbox import SandboxedEnvironment

@app.route('/api/custom-message', methods=['POST'])
def custom_message():
    # User provides CONTENT (data), not TEMPLATE (code)
    user_message = request.json.get('message', '')
    
    # Validate and sanitize
    if len(user_message) > 500:
        return {'error': 'Message too long'}, 400
    
    # SECURE: Load fixed template, insert user content as data
    fixed_template = 'templates/message_card.html'
    
    # User content is inserted as ESCAPED DATA, not template code
    context = {
        'message': user_message,  # Jinja2 auto-escapes by default
        'author': request.user.name
    }
    
    result = render_template(fixed_template, **context)
    return {'rendered': result}

# SECURE: For advanced cases, use sandboxed environment with restricted context
def render_with_sandbox(template_name, context):
    # SECURE: SandboxedEnvironment restricts dangerous operations
    sandbox = SandboxedEnvironment(
        loader=app.jinja_loader,
        autoescape=True  # CRITICAL: Enable autoescaping
    )
    
    # SECURE: Whitelist-only context - no access to app internals
    safe_context = {
        'username': context.get('username', ''),
        'data': context.get('data', {})
        # No __class__, __mro__, config, request, etc.
    }
    
    template = sandbox.get_template(template_name)
    return template.render(**safe_context)

// Node.js/Express + Nunjucks - Secure template handling

const nunjucks = require('nunjucks');
const path = require('path');

// SECURE: Configure Nunjucks with safe settings
const env = nunjucks.configure('templates', {
  autoescape: true,  // CRITICAL: Auto-escape HTML
  throwOnUndefined: false,
  trimBlocks: true,
  lstripBlocks: true,
  noCache: false  // Cache templates for performance
});

// SECURE: Template allowlist
const ALLOWED_TEMPLATES = {
  'welcome': 'welcome.njk',
  'notification': 'notification.njk',
  'email': 'email_base.njk'
};

app.post('/api/email-preview', authenticateSession, (req, res) => {
  const templateKey = req.body.template_key;
  
  // SECURE: Validate against allowlist
  if (!ALLOWED_TEMPLATES[templateKey]) {
    return res.status(400).json({ error: 'Invalid template' });
  }
  
  const templateFile = ALLOWED_TEMPLATES[templateKey];
  
  // SECURE: Minimal, safe context - no dangerous globals
  const context = {
    username: req.user.name,
    email: req.user.email,
    // No access to process, require, global, etc.
  };
  
  try {
    // SECURE: Render fixed template file with safe context
    const rendered = env.render(templateFile, context);
    res.json({ preview: rendered });
  } catch (error) {
    res.status(500).json({ error: 'Rendering failed' });
  }
});

// SECURE: For user-provided CONTENT (not templates)
app.post('/api/custom-email', authenticateSession, (req, res) => {
  const subject = req.body.subject;
  const message = req.body.message;  // User's MESSAGE, not template code
  
  // Validate input
  if (!subject || subject.length > 200) {
    return res.status(400).json({ error: 'Invalid subject' });
  }
  
  if (!message || message.length > 5000) {
    return res.status(400).json({ error: 'Invalid message' });
  }
  
  // SECURE: Use fixed template, insert user content as DATA
  const context = {
    subject: subject,  // Auto-escaped by Nunjucks
    message: message,  // Treated as data, not code
    sender: req.user.name
  };
  
  // SECURE: Fixed template path
  const rendered = env.render('email_custom.njk', context);
  res.json({ preview: rendered });
});

// SECURE: Alternative - use a restricted template language
const Handlebars = require('handlebars');

app.post('/api/generate-report', authenticateSession, (req, res) => {
  const templateKey = req.body.template;
  
  // SECURE: Handlebars is more restricted than Jinja2/Nunjucks
  // No direct access to prototype chain or constructors
  
  // Load fixed template
  const templateSource = fs.readFileSync(
    path.join(__dirname, 'templates', `${templateKey}.hbs`),
    'utf8'
  );
  
  const template = Handlebars.compile(templateSource);
  
  // SECURE: Limited context
  const context = {
    title: req.body.title,
    data: req.body.data,
    user: {
      name: req.user.name,
      email: req.user.email
    }
  };
  
  const result = template(context);
  res.json({ report: result });
});

// SECURE: Disable dangerous helpers and globals
env.addGlobal('process', undefined);  // Remove process access
env.addGlobal('require', undefined);  // Remove require
env.addGlobal('global', undefined);   // Remove global

// SECURE: Content Security Policy for rendered templates
app.use((req, res, next) => {
  res.setHeader(
    'Content-Security-Policy',
    "default-src 'self'; script-src 'self'; object-src 'none';"
  );
  next();
});