template-injection

Template Injection (SSTI)

Rules (for AI agents)

ALWAYS

• Pass user data as bound values, never into the template source string. This is the whole skill in one line: render(tmpl, {"name": name}) is safe, render("Hello " + name) is SSTI. The compiler treats its source as code, and the context as data — so the only question that matters about any user value is which of the two it reaches.
• Keep the set of template sources static and trusted, loaded from files or constants. A template body read from a database column, an API response, or a request field is attacker-supplied code, whatever the column is called.
• Choose the template by name from an allowlist, never by a name the caller supplies. render_template(user_value) and {% include user_value %} are the same vulnerability as a user-supplied body: the caller picks which code runs, and on many engines the name resolves as a filesystem path, which makes it an arbitrary-file read as well.
• Minimize the render context. Pass the specific values the template needs, never the ambient objects — application config, settings, the request, self, a module, a live ORM instance. This is the control that still holds when a sandbox is escaped: an engine that cannot execute code can still print whatever it can reach, and configuration objects hold database URLs and signing keys.
• Treat a second render pass as compilation of whatever survived the first. If rendered output is parsed again, a user value that was inert data on pass one is {{ }} code on pass two. The fix is architectural — stop re-parsing rendered output. Neutralizing metacharacters before the second pass is a fallback that has to enumerate every delimiter of every engine, including ones a custom delimiter configuration introduces, and two adjacent fields can produce a delimiter that neither of them contains.
• Bound the render: cap iteration counts, recursion depth, include depth, output size, and wall-clock time. A template is a denial-of-service sink even where it is not a code-execution one, and an unbounded loop count is one request that allocates until the process dies.
• Keep autoescaping on, and know that autoescape is an XSS control rather than an SSTI one — it escapes what the template prints, not what the template is. frontend-security owns output encoding and the raw-output opt-outs (|safe, {{{ }}}, template.HTML) that turn it off per value.