mattrobenolt/jinja2-cli

Review signals: 33 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

OSV reports a known vulnerability in this dependency version. 3 distinct locations. 33 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• jinja2 renders a template from stdin when data is piped in: Real input produced the expected result: Hello World! Answer=42 stdin

  Source: Read data from files or stdin

  Input: piped JSON data with template from file

  Expected: Hello World! Answer=42 stdin

  Command: <guest-path> <guest-path> - --format json -D foo=stdin

  Observed: Hello World! Answer=42 stdin

• jinja2 accepts inline variables defined with -D: Real input produced the expected result: Hello World! Answer=42 bar

  Source: Define variables inline with `-D key=value`

  Input: template.j2 data.json -D foo=bar

  Expected: Hello World! Answer=42 bar

  Command: <guest-path> <guest-path> <guest-path> --format json -D foo=bar -D answer=42

  Observed: Hello World! Answer=42 bar

• jinja2 loads custom filters from a module given with -F: Real input produced the expected result: dlroW WORLD!

  Source: $ jinja2 template.j2 data.json -F myfilters

  Input: filt.j2 with reverse and shout filters from myfilters.py

  Expected: dlroW WORLD!

  Command: <guest-path> <guest-path> <guest-path> -F myfilters

  Observed: dlroW WORLD!

Examples

• Render a template from a data file in one command, per the quickstart: command completed successfully

  Source: docs/quickstart.md

  Input: template.j2 data.json --format json -D foo=quick

  Expected: Hello World! Answer=42 quick

  Command: <guest-path> <guest-path> <guest-path> --format json -D foo=quick

  Observed: Hello World! Answer=42 quick

• Write rendered output to a file with -o (silent on stdout): command completed successfully

  Source: docs/cli.md

  Input: template.j2 data.json -o out/example.txt -D foo=file

  Expected: file contains Hello World! Answer=42 file

  Command: <guest-path> <guest-path> <guest-path> --format json -D foo=file -o <guest-path>

  Observed: Hello World! Answer=42 file

• Repository test suite passes: command completed successfully

  Source: Justfile (test recipe: uv run pytest -v)

  Input: pytest -v run from the checkout

  Expected: 49 passed, 4 skipped

  Command: <guest-path> -v -p no:cacheprovider

  Observed: [ 88%] tests/test_parse_qs.py::test_parse_qs[foo=-qs_data1] PASSED [ 90%] tests/test_parse_qs.py::test_parse_qs[foo=bar-qs_data2] PASSED [ 92%] tests/test_parse_qs.py::test_parse_qs[foo=bar&ham=spam-qs_data3] PASSED [ 94%] tests/test_parse_qs.py::test_parse_qs[foo.bar=ham&ham.spam=eggs-qs_data4] PASSED [ 96%] tests/test_parse_qs.py::test_parse_qs[foo=bar%20ham%20spam-qs_data5] PASSED [ 98%] tests/test_parse_qs.py::test_parse_qs[foo=bar%2Eham%2Espam-qs_data6] PASSED [100%] ======================== 49 passed, 4 skipped in 1.18s =========================

• Run the bats integration tests: bats is not installed in the guest, so the bats suite was not run; the pytest suite was run instead. Not attempted: sudo apt-get -o DPkg::Lock::Timeout=300 install bats.

  Source: Justfile (bats recipe: bats -T tests/bats)

  Expected: documented command completes successfully

  Observed: bats is not installed in the guest, so the bats suite was not run; the pytest suite was run instead. Not attempted: sudo apt-get -o DPkg::Lock::Timeout=300 install bats.

Local or hosted: local

Render a Jinja2 template with data from a file or stdin using the jinja2 command (pinned jinja2-cli 1.0.1 from the checkout)

cd <guest-path> && pwd && ls -la && id -u && cat /etc/os-release | head -3 && python3 --version && echo "CDP_URL=$CDP_URL" && (curl -s -m 10 -i $CDP_URL/json/version; echo "exit=$?")
cd <guest-path> && cat README.md
cd <guest-path> && cat pyproject.toml && ls -la .coldpass docs jinja2cli tests && cat Justfile | head -60
cd /tmp && python3 -m venv <guest-path> && <guest-path> --version && <guest-path> install -q --upgrade pip 2>&1 | tail -3; <guest-path> install <guest-path> 2>&1 | tail -5; echo "rc=$?"
cd <guest-path> && git status 2>&1 | head -2; ls; cat docs/quickstart.md; cat docs/cli.md | head -70
mkdir -p <guest-path> && cd <guest-path> && printf 'Hello {{ name }}! Answer={{ answer }} {{ foo }}\n' > template.j2 && printf '{"name": "World", "answer": 42}\n' > data.json && <guest-path> template.j2 data.json --format json -D foo=bar -D answer=42; echo "rc=$?"; cat data.json | <guest-path> template.j2 - --format json -D foo=stdin; echo "rc=$?"
cd <guest-path> && mkdir -p <guest-path> && printf 'def reverse(s):\n    return s[::-1]\n\ndef shout(s):\n    return s.upper() + "!"\n' > myfilters.py && printf '{{ name | reverse }} {{ name | shout }}\n' > filt.j2 && <guest-path> filt.j2 data.json -F myfilters; echo "rc=$?"; <guest-path> template.j2 data.json --format json -D foo=file -o <guest-path>; echo "rc=$?"; cat <guest-path>
cd <guest-path> && rm -f <guest-path> && cat > probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","<guest-path>","<guest-path>","--format","json","-D","foo=bar","-D","answer=42"],"cwd":"<guest-path>","expected_text":"Hello World! Answer=42 bar"}
EOF
<guest-path> -m json.tool probe.json >/dev/null 2>&1; python3 -I -c "import json;json.load(open('<guest-path>'));print('ok')"
cd <guest-path> && cat > claims.json <<'EOF'
[
{"kind":"claim","claim":"jinja2 renders a template from stdin when data is piped in","source":"Read data from files or stdin","input":"piped JSON data with template from file","expected":"Hello World! Answer=42 stdin","probe_kind":"cli","argv":["<guest-path>","<guest-path>","-","--format","json","-D","foo=stdin"],"stdin":"{\"name\": \"World\", \"answer\": 42}\n","expected_text":"Hello World! Answer=42 stdin","cwd":"<guest-path>"},
{"kind":"claim","claim":"jinja2 accepts inline variables defined with -D","source":"Define variables inline with `-D key=value`","input":"template.j2 data.json -D foo=bar","expected":"Hello World! Answer=42 bar","probe_kind":"cli","argv":["<guest-path>","<guest-path>","<guest-path>","--format","json","-D","foo=bar","-D","answer=42"],"expected_text":"Hello World! Answer=42 bar","cwd":"<guest-path>"},
{"kind":"claim","claim":"jinja2 loads custom filters from a module given with -F","source":"$ jinja2 template.j2 data.json -F myfilters","input":"filt.j2 with reverse and shout filters from myfilters.py","expected":"dlroW WORLD!","probe_kind":"cli","argv":["<guest-path>","<guest-path>","<guest-path>","-F","myfilters"],"expected_text":"dlroW WORLD!","cwd":"<guest-path>"}
]
EOF
python3 -I -c "import json;print(len(json.load(open('<guest-path>'))))"
cd <guest-path> && cat > cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: jinja2cli/cli.py (main() renders one template per invocation from argv/stdin and exits), pyproject.toml [project.scripts] jinja2 = jinja2cli:main, docs/cli.md. No cron, scheduler, loop, webhook, --once or --now option exists; the tool runs once per invocation and is run by the user or by external schedulers.","checks":[]}
EOF
cat > examples.json <<'EOF'
[
{"kind":"example","claim":"Render a template from a data file in one command, per the quickstart","source":"docs/quickstart.md","input":"template.j2 data.json --format json -D foo=quick","expected":"Hello World! Answer=42 quick","argv":["<guest-path>","<guest-path>","<guest-path>","--format","json","-D","foo=quick"],"cwd":"<guest-path>","expected_text":"Hello World! Answer=42 quick"},
{"kind":"example","claim":"Write rendered output to a file with -o (silent on stdout)","source":"docs/cli.md","input":"template.j2 data.json -o out/example.txt -D foo=file","expected":"file contains Hello World! Answer=42 file","argv":["<guest-path>","<guest-path>","<guest-path>","--format","json","-D","foo=file","-o","<guest-path>"],"cwd":"<guest-path>","expected_file":"<guest-path>","expected_text":"Hello World! Answer=42 file"}
]
EOF
python3 -I -c "import json;json.load(open('<guest-path>'));json.load(open('<guest-path>'));print('ok')"
cd <guest-path> && <guest-path> install -q pytest 2>&1 | tail -2; PYTHONDONTWRITEBYTECODE=1 <guest-path> -v -p no:cacheprovider 2>&1 | tail -40; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && python3 -I - <<'EOF'
import json
p='<guest-path>'
ex=json.load(open(p))
ex.append({"kind":"example","claim":"Repository test suite passes","source":"Justfile (test recipe: uv run pytest -v)","input":"pytest -v run from the checkout","expected":"49 passed, 4 skipped","argv":["<guest-path>","-v","-p","no:cacheprovider"],"cwd":"<guest-path>","env":{"PYTHONDONTWRITEBYTECODE":"1"},"expected_text":"49 passed, 4 skipped"})
ex.append({"kind":"example","claim":"Run the bats integration tests","source":"Justfile (bats recipe: bats -T tests/bats)","reason":"bats is not installed in the guest and the bats suite was not run; the pytest suite was run instead. Install would be sudo apt-get -o DPkg::Lock::Timeout=300 install bats (not attempted).","deferred":false})
json.dump(ex,open(p,'w'),indent=1)
print(len(ex))
EOF
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && python3 -I - <<'EOF'
import json
p='<guest-path>'
ex=json.load(open(p))
ex.append({"kind":"example","claim":"Repository test suite passes","source":"Justfile (test recipe: uv run pytest -v)","input":"pytest -v run from the checkout","expected":"49 passed, 4 skipped","argv":["<guest-path>","-v","-p","no:cacheprovider"],"cwd":"<guest-path>","env":{"PYTHONDONTWRITEBYTECODE":"1"},"expected_text":"49 passed, 4 skipped"})
ex.append({"kind":"example","claim":"Run the bats integration tests","source":"Justfile (bats recipe: bats -T tests/bats)","reason":"bats is not installed in the guest, so the bats suite was not run; the pytest suite was run instead. Not attempted: sudo apt-get -o DPkg::Lock::Timeout=300 install bats.","deferred":False})
json.dump(ex,open(p,'w'),indent=1)
print(len(ex))
EOF
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "rc=$?"; python3 -I -c "
import json
d=json.load(open('<guest-path>'))
print('valid',d.get('valid'),d.get('problems'))
print('replay',d['replay']['status'])
r=d['replay']['details']
print([c.get('verdict') for c in r['claims']], [e.get('verdict') for e in r['example_checks']], [e.get('outcome') for e in r['example_checks']])
"
cd <guest-path> && python3 -I - <<'EOF'
import json
rep={
"outcome":"working",
"fault_owner":None,
"operation":"Render a Jinja2 template with data from a file or stdin using the jinja2 command (pinned jinja2-cli 1.0.1 from the checkout)",
"operation_scope":"Ubuntu 24.04 guest, Python 3.12.3, venv at <guest-path> with jinja2 3.1.6 and the checkout installed. Built-in JSON format only; optional yaml/xml/hjson/json5 extras not installed. No browser, network service or credentials needed.",
"steps":[
"python3 -m venv <guest-path>",
"<guest-path> install <guest-path>   (README: pip install jinja2-cli)",
"<guest-path> template.j2 data.json --format json -D foo=bar -D answer=42",
"cat data.json | <guest-path> template.j2 - --format json -D foo=stdin",
"<guest-path> filt.j2 data.json -F myfilters   (README custom filters example)",
"<guest-path> template.j2 data.json --format json -D foo=file -o <guest-path>",
"<guest-path> install pytest; <guest-path> -v -p no:cacheprovider   (Justfile test recipe)"
],
"deviations":[
"Installed from the local pinned checkout (pip install <guest-path>) instead of PyPI pip install jinja2-cli, so the tested code is exactly the pinned source.",
"Installed pytest into the venv because the Justfile test recipe uses it (uv was not installed; pytest was run directly instead of uv run pytest).",
"The bats integration suite (Justfile bats recipe) was not run: bats is not installed in the guest. Not attempted: sudo apt-get -o DPkg::Lock::Timeout=300 install bats.",
"Sample template and data were created in <guest-path> because the checkout has no sample files. A cached demo output file from one manual run was removed before replay.",
"No uv installed; README's uv tool install path was not used."
],
"stuck_step":None,
"main_blocker":None,
"plain_failure":None,
"suggested_fix":"None required for the tested CLI operations. Optional: install bats and run the bats suite to cover integration tests."
}
json.dump(rep,open('<guest-path>','w'),indent=1)
print("ok")
EOF
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "rc=$?"; python3 -I -c "
import json
d=json.load(open('<guest-path>'))
print('valid',d.get('valid'),d.get('problems'),'replay',d['replay']['status'])"; ls -la <guest-path>; ls <guest-path> | head -30