[Django] #27678: Document that the template system isn't safe against untrusted template authors

[Django]

#27678: Document that the template system isn't safe against untrusted template
authors
------------------------------------------------+------------------------
Reporter: Tim Graham | Owner: nobody
Type: Cleanup/optimization | Status: new
Component: Documentation | Version: master
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
------------------------------------------------+------------------------
A few times (e.g. #12772) and in some security reports, the question has
come up about whether or not the Django template language is safe against
untrusted template authors. We should document that it is not, perhaps in
docs/topics/templates.txt.

--
Ticket URL: <https://code.djangoproject.com/ticket/27678>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#27678: Document that the template system isn't safe against untrusted template
authors

--------------------------------------+------------------------------------

Reporter: Tim Graham | Owner: nobody
Type: Cleanup/optimization | Status: new
Component: Documentation | Version: master

Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted

Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

--------------------------------------+------------------------------------
Changes (by Tim Graham):

* stage: Unreviewed => Accepted

--
Ticket URL: <https://code.djangoproject.com/ticket/27678#comment:1>

[Django]

#27678: Document that the template system isn't safe against untrusted template
authors

-------------------------------------+-------------------------------------
Reporter: Tim Graham | Owner: Andrew
Type: | Nester
Cleanup/optimization | Status: assigned
Component: Documentation | Version: master

Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted

Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

-------------------------------------+-------------------------------------
Changes (by Andrew Nester):

* status: new => assigned
* owner: nobody => Andrew Nester
* has_patch: 0 => 1

Comment:

I created PR for this ticket [https://github.com/django/django/pull/7813
PR]

--
Ticket URL: <https://code.djangoproject.com/ticket/27678#comment:2>

[Django]

#27678: Document that the template system isn't safe against untrusted template
authors

-------------------------------------+-------------------------------------
Reporter: Tim Graham | Owner: Andrew
Type: | Nester
Cleanup/optimization | Status: assigned

Component: Documentation | Version: master

Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted

Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 1

Easy pickings: 0 | UI/UX: 0

-------------------------------------+-------------------------------------
Changes (by Tim Graham):

* needs_better_patch: 0 => 1

--
Ticket URL: <https://code.djangoproject.com/ticket/27678#comment:3>

[Django]

#27678: Document that the template system isn't safe against untrusted template
authors

-------------------------------------+-------------------------------------
Reporter: Tim Graham | Owner: Andrew
Type: | Nester
Cleanup/optimization | Status: assigned

Component: Documentation | Version: master

Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted

Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

-------------------------------------+-------------------------------------
Changes (by Andrew Nester):

* needs_better_patch: 1 => 0

Comment:

I updated PR according changes requested.

--
Ticket URL: <https://code.djangoproject.com/ticket/27678#comment:4>

[Django]

#27678: Document that the template system isn't safe against untrusted template
authors

-------------------------------------+-------------------------------------
Reporter: Tim Graham | Owner: Andrew
Type: | Nester

Cleanup/optimization | Status: closed
Component: Documentation | Version: master
Severity: Normal | Resolution: fixed
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

-------------------------------------+-------------------------------------
Changes (by Tim Graham <timograham@…>):

* status: assigned => closed
* resolution: => fixed

Comment:

In [changeset:"d2e40dd8c2031cd03700e72d87d455d5e974800c" d2e40dd]:
{{{
#!CommitTicketReference repository=""
revision="d2e40dd8c2031cd03700e72d87d455d5e974800c"
Fixed #27678 -- Warned that the template system isn't safe against
untrusted authors.
}}}

--
Ticket URL: <https://code.djangoproject.com/ticket/27678#comment:5>

[Django]

#27678: Document that the template system isn't safe against untrusted template
authors

-------------------------------------+-------------------------------------
Reporter: Tim Graham | Owner: Andrew
Type: | Nester
Cleanup/optimization | Status: closed

Component: Documentation | Version: master

Severity: Normal | Resolution: fixed
Keywords: | Triage Stage: Accepted

Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

-------------------------------------+-------------------------------------

Comment (by Tim Graham <timograham@…>):

In [changeset:"d9f2887645e8babd332afdf971dc66a02428eaff" d9f28876]:
{{{
#!CommitTicketReference repository=""
revision="d9f2887645e8babd332afdf971dc66a02428eaff"
[1.11.x] Fixed #27678 -- Warned that the template system isn't safe
against untrusted authors.

Backport of d2e40dd8c2031cd03700e72d87d455d5e974800c from master
}}}

--
Ticket URL: <https://code.djangoproject.com/ticket/27678#comment:6>