src/cleveragents/templates/inline_jinja_handler.py

@@ -14,7 +14,7 @@ from typing import List
 from typing import Optional
 
 import yaml
-from jinja2 import Environment
+from jinja2.sandbox import SandboxedEnvironment
 
 logger = logging.getLogger(__name__)
 
@@ -32,7 +32,8 @@ class InlineJinjaHandler:
     """
 
     def __init__(self) -> None:
-        self.env = Environment(
+        # Security: Use SandboxedEnvironment to prevent code execution
+        self.env = SandboxedEnvironment(
             block_start_string="{%",
             block_end_string="%}",
             variable_start_string="{{",
@@ -41,6 +42,7 @@ class InlineJinjaHandler:
             comment_end_string="#}",
             trim_blocks=True,
             lstrip_blocks=True,
+            autoescape=False,
         )
 
     def process_yaml_file(

src/cleveragents/templates/inline_yaml_jinja.py

@@ -14,7 +14,7 @@ from typing import List
 from typing import Optional
 
 import yaml
-from jinja2 import Environment
+from jinja2.sandbox import SandboxedEnvironment
 
 logger = logging.getLogger(__name__)
 
@@ -31,14 +31,15 @@ class InlineYAMLJinja:
     """
 
     def __init__(self) -> None:
-        # Configure Jinja2 to work well with YAML
-        self.env = Environment(
+        # Use SandboxedEnvironment to prevent code execution
+        self.env = SandboxedEnvironment(
             block_start_string="{%",
             block_end_string="%}",
             variable_start_string="{{",
             variable_end_string="}}",
             comment_start_string="{#",
             comment_end_string="#}",
+            autoescape=False,
         )
 
         # Add useful filters

src/cleveragents/templates/jinja_yaml_preprocessor.py

@@ -13,7 +13,7 @@ from typing import List
 from typing import Optional
 
 import yaml
-from jinja2 import Environment
+from jinja2.sandbox import SandboxedEnvironment
 
 logger = logging.getLogger(__name__)
 
@@ -30,7 +30,8 @@ class JinjaYAMLPreprocessor:
     """
 
     def __init__(self) -> None:
-        self.env = Environment(
+        # Use SandboxedEnvironment to prevent code execution
+        self.env = SandboxedEnvironment(
             block_start_string="{%",
             block_end_string="%}",
             variable_start_string="{{",
@@ -39,6 +40,7 @@ class JinjaYAMLPreprocessor:
             comment_end_string="#}",
             trim_blocks=True,
             lstrip_blocks=True,
+            autoescape=False,
         )
 
     def load_file(

src/cleveragents/templates/yaml_jinja_loader.py

@@ -13,7 +13,7 @@ from typing import Optional
 from typing import Tuple
 
 import yaml
-from jinja2 import Environment
+from jinja2.sandbox import SandboxedEnvironment
 
 logger = logging.getLogger(__name__)
 
@@ -27,7 +27,8 @@ class YAMLJinjaLoader:
     """
 
     def __init__(self) -> None:
-        self.env = Environment(
+        #Use SandboxedEnvironment to prevent code execution
+        self.env = SandboxedEnvironment(
             block_start_string="{%",
             block_end_string="%}",
             variable_start_string="{{",
@@ -36,6 +37,7 @@ class YAMLJinjaLoader:
             comment_end_string="#}",
             trim_blocks=True,
             lstrip_blocks=True,
+            autoescape=False,
         )
 
     def load_file(

src/cleveragents/templates/yaml_preprocessor.py

@@ -12,8 +12,8 @@ from typing import Any
 from typing import Optional
 
 import yaml
-from jinja2 import Environment
 from jinja2 import meta
+from jinja2.sandbox import SandboxedEnvironment
 
 logger = logging.getLogger(__name__)
 
@@ -27,7 +27,8 @@ class YAMLTemplateProcessor:
     """
 
     def __init__(self) -> None:
-        self.env = Environment(
+        #Use SandboxedEnvironment to prevent code execution
+        self.env = SandboxedEnvironment(
             block_start_string="{%",
             block_end_string="%}",
             variable_start_string="{{",
@@ -36,6 +37,7 @@ class YAMLTemplateProcessor:
             comment_end_string="#}",
             trim_blocks=True,
             lstrip_blocks=True,
+            autoescape=False,
         )
 
     def process_file(self, file_path: Path, context: dict[str, Any]) -> dict[str, Any]:

src/cleveragents/templates/yaml_template_engine.py

@@ -14,7 +14,7 @@ from typing import Optional
 from typing import Tuple
 
 import yaml
-from jinja2 import Environment
+from jinja2.sandbox import SandboxedEnvironment
 
 logger = logging.getLogger(__name__)
 
@@ -31,17 +31,17 @@ class YAMLTemplateEngine:
     """
 
     def __init__(self) -> None:
-        # Configure Jinja2 for YAML-friendly output
-        self.env = Environment(
+        self.env = SandboxedEnvironment(
             block_start_string="{%",
             block_end_string="%}",
             variable_start_string="{{",
             variable_end_string="}}",
             comment_start_string="{#",
             comment_end_string="#}",
-            trim_blocks=False,  # Don't trim to preserve structure
-            lstrip_blocks=False,  # Don't strip to preserve indentation
+            trim_blocks=False,
+            lstrip_blocks=False,
             keep_trailing_newline=True,
+            autoescape=False,
         )
 
         # Add custom filters for YAML