zlei6/ragflow
1
0
Fork 0
mirror of https://github.com/infiniflow/ragflow.git synced 2026-07-23 08:56:42 +08:00
Code Issues Packages Projects Releases Wiki Activity

[Security] Fix jinja2 SSTI vulnerability using SandboxedEnvironment (#14068)

Browse Source
This commit is contained in:
Tong Liu
2026-04-13 19:24:13 +08:00
committed by GitHub
parent a023305b96
commit 6fdca2d212
2 changed files with 70 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
rag/prompts/generator.py
View File

@@ -20,7 +20,7 @@ import logging
import re
from copy import deepcopy
from typing import Tuple
import jinja2
from jinja2.sandbox import SandboxedEnvironment
import json_repair
from common.misc_utils import hash_str2int
from rag.nlp import rag_tokenizer
@@ -183,7 +183,9 @@ RANK_MEMORY = load_prompt("rank_memory")
META_FILTER = load_prompt("meta_filter")
ASK_SUMMARY = load_prompt("ask_summary")
PROMPT_JINJA_ENV = jinja2.Environment(autoescape=False, trim_blocks=True, lstrip_blocks=True)
PROMPT_JINJA_ENV = SandboxedEnvironment(
autoescape=False, trim_blocks=True, lstrip_blocks=True
)
def citation_prompt(user_defined_prompts: dict = {}) -> str: