mirror of
https://github.com/askama-rs/askama.git
synced 2025-09-27 13:00:57 +00:00
e80b710f67
If you want to fuzz the code generator, it's essential that no local
files are accessed, e.g. through `{% import %}`.
This DOES NOT mean that the generated code is safe; this is not a
sandbox. The generated code can still contain
* evil compile-time code: `{{ include_str!("/etc/passwd") }}`
* evil runtime code: `{{ std::fs::remove_dir_all("/home/user") %}`
But during the code generation nothing potentially bad should happen.
