From c3ea7d7def695cf09a07117b808da47639833954 Mon Sep 17 00:00:00 2001
From: Lumir Balhar <lbalhar@redhat.com>
Date: Wed, 22 Jan 2025 11:48:06 +0100
Subject: [PATCH] CVE-2024-56326

---
 src/jinja2/sandbox.py  | 65 +++++++++++++++++++++++-------------------
 tests/test_security.py | 17 +++++++++++
 2 files changed, 53 insertions(+), 29 deletions(-)

diff --git a/src/jinja2/sandbox.py b/src/jinja2/sandbox.py
index cfd7993..da26866 100644
--- a/src/jinja2/sandbox.py
+++ b/src/jinja2/sandbox.py
@@ -6,6 +6,7 @@ import operator
 import types
 import warnings
 from collections import deque
+from functools import update_wrapper
 from string import Formatter
 
 from markupsafe import EscapeFormatter
@@ -153,16 +154,6 @@ class _MagicFormatMapping(abc.Mapping):
         return len(self._kwargs)
 
 
-def inspect_format_method(callable):
-    if not isinstance(
-        callable, (types.MethodType, types.BuiltinMethodType)
-    ) or callable.__name__ not in ("format", "format_map"):
-        return None
-    obj = callable.__self__
-    if isinstance(obj, string_types):
-        return obj
-
-
 def safe_range(*args):
     """A range that can't generate ranges with a length of more than
     MAX_RANGE items.
@@ -394,6 +385,9 @@ class SandboxedEnvironment(Environment):
                     except AttributeError:
                         pass
                     else:
+                        fmt = self.wrap_str_format(value)
+                        if fmt is not None:
+                            return fmt
                         if self.is_safe_attribute(obj, argument, value):
                             return value
                         return self.unsafe_undefined(obj, argument)
@@ -411,6 +405,9 @@ class SandboxedEnvironment(Environment):
             except (TypeError, LookupError):
                 pass
         else:
+            fmt = self.wrap_str_format(value)
+            if fmt is not None:
+                return fmt
             if self.is_safe_attribute(obj, attribute, value):
                 return value
             return self.unsafe_undefined(obj, attribute)
@@ -426,34 +423,44 @@ class SandboxedEnvironment(Environment):
             exc=SecurityError,
         )
 
-    def format_string(self, s, args, kwargs, format_func=None):
-        """If a format call is detected, then this is routed through this
-        method so that our safety sandbox can be used for it.
+    def wrap_str_format(self, value):
+        """If the given value is a ``str.format`` or ``str.format_map`` method,
+        return a new function than handles sandboxing. This is done at access
+        rather than in :meth:`call`, so that calls made without ``call`` are
+        also sandboxed.
         """
-        if isinstance(s, Markup):
-            formatter = SandboxedEscapeFormatter(self, s.escape)
+        if not isinstance(
+            value, (types.MethodType, types.BuiltinMethodType)
+        ) or value.__name__ not in ("format", "format_map"):
+            return None
+        f_self = value.__self__
+        if not isinstance(f_self, str):
+            return None
+        str_type = type(f_self)
+        is_format_map = value.__name__ == "format_map"
+        if isinstance(f_self, Markup):
+            formatter = SandboxedEscapeFormatter(self, escape=f_self.escape)
         else:
             formatter = SandboxedFormatter(self)
 
-        if format_func is not None and format_func.__name__ == "format_map":
-            if len(args) != 1 or kwargs:
-                raise TypeError(
-                    "format_map() takes exactly one argument %d given"
-                    % (len(args) + (kwargs is not None))
-                )
+        vformat = formatter.vformat
+        def wrapper(*args, **kwargs):
+            if is_format_map:
+                if kwargs:
+                    raise TypeError("format_map() takes no keyword arguments")
+                if len(args) != 1:
+                    raise TypeError(
+                        f"format_map() takes exactly one argument ({len(args)} given)"
+                    )
+                kwargs = args[0]
+                args = ()
 
-            kwargs = args[0]
-            args = None
+            return str_type(vformat(f_self, args, kwargs))
 
-        kwargs = _MagicFormatMapping(args, kwargs)
-        rv = formatter.vformat(s, args, kwargs)
-        return type(s)(rv)
+        return update_wrapper(wrapper, value)
 
     def call(__self, __context, __obj, *args, **kwargs):  # noqa: B902
         """Call an object from sandboxed code."""
-        fmt = inspect_format_method(__obj)
-        if fmt is not None:
-            return __self.format_string(fmt, args, kwargs, __obj)
 
         # the double prefixes are to avoid double keyword argument
         # errors when proxying the call.
diff --git a/tests/test_security.py b/tests/test_security.py
index 7e8974c..2e2af69 100644
--- a/tests/test_security.py
+++ b/tests/test_security.py
@@ -208,3 +208,20 @@ class TestStringFormatMap(object):
             '{{ ("a{x.foo}b{y}"|safe).format_map({"x":{"foo": 42}, "y":"<foo>"}) }}'
         )
         assert t.render() == "a42b&lt;foo&gt;"
+
+    def test_indirect_call(self):
+        def run(value, arg):
+            return value.run(arg)
+
+        env = SandboxedEnvironment()
+        env.filters["run"] = run
+        t = env.from_string(
+            """{% set
+                ns = namespace(run="{0.__call__.__builtins__[__import__]}".format)
+            %}
+            {{ ns | run(not_here) }}
+            """
+        )
+
+        with pytest.raises(SecurityError):
+            t.render()
-- 
2.48.0