add MutableSequence.{clear,pop} to modifies_known_mutable check

pallets · Oct 4, 2024 · c3ab87b · c3ab87b
1 parent eb0df04
commit c3ab87b
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/src/jinja2/sandbox.py b/src/jinja2/sandbox.py
@@ -60,7 +60,9 @@
     ),
     (
         abc.MutableSequence,
-        frozenset(["append", "reverse", "insert", "sort", "extend", "remove"]),
+        frozenset(
+            ["append", "clear", "pop", "reverse", "insert", "sort", "extend", "remove"]
+        ),
     ),
     (
         deque,

diff --git a/tests/test_security.py b/tests/test_security.py
@@ -58,6 +58,8 @@ def test_unsafe(self, env):
     def test_immutable_environment(self, env):
         env = ImmutableSandboxedEnvironment()
         pytest.raises(SecurityError, env.from_string("{{ [].append(23) }}").render)
+        pytest.raises(SecurityError, env.from_string("{{ [].clear() }}").render)
+        pytest.raises(SecurityError, env.from_string("{{ [1].pop() }}").render)
         pytest.raises(SecurityError, env.from_string("{{ {1:2}.clear() }}").render)
 
     def test_restricted(self, env):