template-injectionlisted

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/template-injection/SKILL.md. --> # Template Injection (SSTI) Prevent server-side template injection — user input reaching a template compiler, double-render pipelines, sandbox escapes, and template-driven resource exhaustion ## ALWAYS - Pass user data to a template only as **bound values / context variables**, never concatenated or interpolated into the template **source** string. `render(tmpl, {name})` is safe; `render("Hello " + name)` is SSTI. - Keep the set of template sources **static and trusted** — load them from files or constants the user cannot influence. A template whose text comes from the DB, an API response, or a request field is attacker-controlled *code*, not data. - Treat any **second render pass** as code execution. If the output of one render is parsed and executed as a template again (double render), a user value that survived the first pass as data becomes `{{ }}` code on the second. Never re-parse rendered output; if a two-step render is unavoidable, escape/neutralise template metacharacters (`{{`, `{%`, `${`, `#{`, `<%`) in user fields before the second pass. - Use a **sandboxed / logic-less** engine for user-authored templates (Handlebars, Liquid, Jinja2 `SandboxedEnvironment`) and deny attribute/builtin/internals access (`__class__`, `__globals__`, `constructor`, `getClass()`). -