fix(actor): Restrict Jinja2 sandbox built-ins to prevent DoS attacks #10575

New issue

Open

opened 2026-04-18 17:30:20 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-18 17:30:20 +00:00

Owner

Metadata

Commit: April 6, 2026
Branch: main
Module: src/cleveragents/actor/yaml_template_engine.py

Background and Context

The YAMLTemplateEngine class uses Jinja2's SandboxedEnvironment to safely render templates, but it exposes potentially dangerous built-in functions like range(), abs(), round(), len(), min(), max(), and sum(). An attacker who can control template content could use these functions to perform denial-of-service attacks, such as creating extremely large ranges or performing expensive computations.

Code Evidence

Lines 30-45 in src/cleveragents/actor/yaml_template_engine.py:

def __init__(self) -> None:
    # Configure Jinja2 for YAML-friendly output
    self.env = SandboxedEnvironment(...)

    # Add custom filters for YAML
    self.env.filters["yaml"] = self._yaml_filter
    self.env.filters["indent"] = self._indent_filter
    self.env.filters["sum"] = self._sum_filter
    self.env.filters["selectattr"] = cast(...)

    # Expose safe Python built-ins commonly used in templates (v2 parity)
    env_globals = cast(MutableMapping[str, Any], self.env.globals)
    env_globals.update(
        cast(
            dict[str, Any],
            {
                "range": range,  # <-- Can be used for DoS: range(10**9)
                "abs": abs,
                "round": round,
                "len": len,
                "min": min,
                "max": max,
                "sum": sum,  # <-- Also exposed as filter
            },
        )
    )

DoS Attack Vectors

The range() function is particularly dangerous because it can be used to create extremely large iterables that consume memory and CPU:

{{ range(10**9) | list }} would attempt to create a list with 1 billion elements
{% for i in range(10**9) %}...{% endfor %} would attempt to iterate 1 billion times

Expected Behavior

The YAMLTemplateEngine should:

Only expose built-in functions that are truly necessary for template rendering
Restrict or remove dangerous functions like range() that can be abused for DoS attacks
Enforce resource limits (timeout, memory) on template rendering
Provide clear documentation about which built-ins are available and why

Acceptance Criteria

range() function is either removed or wrapped with a maximum limit
sum() filter is removed or restricted to prevent abuse
Only necessary built-ins are exposed in the sandbox
Documentation explains which built-ins are available and why
Resource limits are enforced on template rendering
All existing tests pass
Code coverage remains >=97%

Subtasks

Audit which built-ins are actually used in templates across the codebase
Remove unused built-ins from env_globals
Wrap range() with a maximum limit (e.g., max 10,000 items)
Add timeout to template rendering
Create test cases with DoS attack patterns to verify prevention
Update documentation with list of available built-ins

Definition of Done

This issue is complete when:

Unnecessary built-ins are removed from the sandbox
range() is limited to prevent memory exhaustion
Template rendering has a timeout mechanism
Test cases verify DoS attacks are prevented
All existing tests pass
Code coverage remains >=97%
Documentation is updated

Automated by CleverAgents Bot
Agent: new-issue-creator

## Metadata - **Commit**: April 6, 2026 - **Branch**: main - **Module**: src/cleveragents/actor/yaml_template_engine.py ## Background and Context The YAMLTemplateEngine class uses Jinja2's SandboxedEnvironment to safely render templates, but it exposes potentially dangerous built-in functions like `range()`, `abs()`, `round()`, `len()`, `min()`, `max()`, and `sum()`. An attacker who can control template content could use these functions to perform denial-of-service attacks, such as creating extremely large ranges or performing expensive computations. ### Code Evidence Lines 30-45 in `src/cleveragents/actor/yaml_template_engine.py`: ```python def __init__(self) -> None: # Configure Jinja2 for YAML-friendly output self.env = SandboxedEnvironment(...) # Add custom filters for YAML self.env.filters["yaml"] = self._yaml_filter self.env.filters["indent"] = self._indent_filter self.env.filters["sum"] = self._sum_filter self.env.filters["selectattr"] = cast(...) # Expose safe Python built-ins commonly used in templates (v2 parity) env_globals = cast(MutableMapping[str, Any], self.env.globals) env_globals.update( cast( dict[str, Any], { "range": range, # <-- Can be used for DoS: range(10**9) "abs": abs, "round": round, "len": len, "min": min, "max": max, "sum": sum, # <-- Also exposed as filter }, ) ) ``` ### DoS Attack Vectors The `range()` function is particularly dangerous because it can be used to create extremely large iterables that consume memory and CPU: - `{{ range(10**9) | list }}` would attempt to create a list with 1 billion elements - `{% for i in range(10**9) %}...{% endfor %}` would attempt to iterate 1 billion times ## Expected Behavior The YAMLTemplateEngine should: 1. Only expose built-in functions that are truly necessary for template rendering 2. Restrict or remove dangerous functions like `range()` that can be abused for DoS attacks 3. Enforce resource limits (timeout, memory) on template rendering 4. Provide clear documentation about which built-ins are available and why ## Acceptance Criteria - [ ] `range()` function is either removed or wrapped with a maximum limit - [ ] `sum()` filter is removed or restricted to prevent abuse - [ ] Only necessary built-ins are exposed in the sandbox - [ ] Documentation explains which built-ins are available and why - [ ] Resource limits are enforced on template rendering - [ ] All existing tests pass - [ ] Code coverage remains >=97% ## Subtasks - [ ] Audit which built-ins are actually used in templates across the codebase - [ ] Remove unused built-ins from `env_globals` - [ ] Wrap `range()` with a maximum limit (e.g., max 10,000 items) - [ ] Add timeout to template rendering - [ ] Create test cases with DoS attack patterns to verify prevention - [ ] Update documentation with list of available built-ins ## Definition of Done This issue is complete when: - Unnecessary built-ins are removed from the sandbox - `range()` is limited to prevent memory exhaustion - Template rendering has a timeout mechanism - Test cases verify DoS attacks are prevented - All existing tests pass - Code coverage remains >=97% - Documentation is updated --- **Automated by CleverAgents Bot** Agent: new-issue-creator

HAL9000 added the

labels

2026-04-18 17:35:33 +00:00