[Security] CVE-2019-8341 advice please about dbt-core HOT 6 CLOSED

Yes please @dbeatty10 - I've done my own assessment (https://tempered.works/posts/2024/06/02/handling-cve-2019-8341-for-dbt-and-mkdocs/) but always helpful to get an all-clear and probably useful for others who might be getting pinged by safety as of Saturday!

from dbt-core.

We took an initial look internally, and:

• dbt-core does indeed run Jinja2 sandboxed
• Here in get_template is where we load the template using from_string, after calling get_environment.

We believe the environment we're loading there should always be a subclass of jinja2.sandbox.SandboxedEnvironment, but we're going to double-check with one of our engineers.

from dbt-core.

Yes, we always subclass from SandboxedEnvironment.

from dbt-core.

Thank you @gshank 👍

@brabster I'm going to close this as resolved, but just let us know if you have any outstanding concerns and we can take another look.

from dbt-core.

Thanks for reaching out about this @brabster !

Sounds like you'd just like us to take a look and confirm that dbt-core is not affected by CVE-2019-8341?

Specifically:

• Confirm that dbt-core runs Jinja2 sandboxed
• If not, confirm that dbt-core does not use from_string

from dbt-core.

Quoting https://bugzilla.redhat.com/show_bug.cgi?id=1677653#c4
"I'm one of the maintainers of the Pallets projects, including Jinja.
This CVE is a bad joke. It's like claiming eval() in the Python stdlib is insecure because it executes code.
Jinja templates should never be loaded from untrusted sources.
So nothing should be done here, there is literally nothing to be fixed."

from dbt-core.