feat(allowlist): add Jinja template support

internal/config/allowlist/allowed_ext_test.go

@@ -41,6 +41,10 @@ func TestIsAllowedExt(t *testing.T) {
 		{".HBS", true},
 		{".mustache", true},
 		{".MUSTACHE", true},
+		{".jinja2", true},
+		{".JINJA2", true},
+		{".j2", true},
+		{".J2", true},
 		{".graphql", true},
 		{".GRAPHQL", true},
 		{".gql", true},

internal/config/allowlist/supported_file_types.json

@@ -49,6 +49,8 @@
   ".ftlx",
   ".hbs",
   ".mustache",
+  ".jinja2",
+  ".j2",
   ".astro",
   ".vue",
   ".ipynb",

internal/config/rules/rule_docs/jinja.md

@@ -0,0 +1,37 @@
+> Favor precision over recall: only raise an issue when you are confident it is a real defect, and stay silent when the host application's Jinja environment or data trust boundary is not visible.
+
+#### Jinja Escaping Boundaries
+- Untrusted values passed through `|safe`, wrapped in `Markup`, or rendered inside `{% autoescape false %}` without prior context-appropriate sanitization
+- HTML-escaped values inserted into JavaScript, CSS, URL, or event-handler contexts as though HTML escaping protected those grammars
+- `|tojson` output placed in a double-quoted HTML attribute; Jinja documents that this requires single-quoted attributes or additional escaping
+- Interpolated values in unquoted HTML attributes, where escaping alone does not establish an attribute boundary
+- Do not report every `{{ value }}` as unescaped: autoescaping is configured by the host environment and may be selected from the template filename
+
+#### Template and Expression Injection
+- User-controlled template source, expression fragments, filter names, or macro bodies evaluated as Jinja rather than passed as data
+- Dynamic `{% include %}`, `{% import %}`, or `{% extends %}` targets derived from request data without an explicit allowlist
+- Use of attribute traversal or the `attr` filter to reach sensitive host objects exposed to an untrusted template
+- Treat `SandboxedEnvironment` as defense in depth, not permission to expose secrets or powerful application objects to attacker-authored templates
+
+#### Undefined Values and Defaults
+- Required values silently rendered as empty strings under the default `Undefined` behavior, especially in identifiers, URLs, authorization decisions, or generated configuration
+- `|default(..., true)` used where valid falsey values such as `0`, `False`, or an empty collection must remain distinct from missing data
+- Deep attribute chains whose intermediate value may be undefined, unless the environment clearly uses `ChainableUndefined` or a guard establishes the value
+- Do not require `StrictUndefined` in every application; report the concrete silent-failure path instead
+
+#### Includes, Imports, and Macros
+- Macros depending on ambient variables even though imported templates do not receive the caller's context by default
+- `{% include %}` unintentionally inheriting sensitive caller context when `without context` is required
+- Macro calls where missing arguments become `Undefined`, positional arguments are misordered, or unintended extra arguments are captured through `varargs` or `kwargs`
+- Child templates overriding a block but omitting `{{ super() }}` when the parent block contains required structure or security metadata
+
+#### Output Correctness
+- Whitespace-control markers (`{%-`, `-%}`, `{{-`, `-}}`) that concatenate tokens, lines, HTML attributes, YAML scalars, or generated source unexpectedly
+- Conditions that emit only one half of a required delimiter, tag, quote, or structured-output field
+- Loop metadata such as `loop.index` and `loop.index0` mixed in the same external identifier or pagination calculation
+- Reusing a loop variable after the loop as though assignments inside loops escaped Jinja's loop scope
+
+#### Performance and Side Effects
+- Host functions, database-backed properties, or network lookups invoked repeatedly inside a loop when the result can be prepared once by the application
+- Repeated sorting, grouping, filtering, or serialization of the same collection within one render
+- Includes or imports selected per item in a large loop when a fixed macro or precomputed view model would avoid repeated loader work

internal/config/rules/system_rules.json

@@ -16,6 +16,7 @@
     "**/*.go": "go.md",
     "**/*.{ftl,ftlh,ftlx}": "freemarker.md",
     "**/*.{hbs,mustache}": "handlebars_mustache.md",
+    "**/*.{jinja2,j2}": "jinja.md",
     "**/*.ets": "arkts.md",
     "**/*.astro": "astro.md",
     "**/*.{ts,js,tsx,jsx}": "ts_js_tsx_jsx.md",

internal/config/rules/system_rules_test.go

@@ -76,6 +76,10 @@ func TestResolve_DefaultRules(t *testing.T) {
 		{"templates/account.HBS", "Handlebars/Mustache Escaping Boundaries"},
 		{"templates/email.mustache", "Handlebars/Mustache Escaping Boundaries"},
 		{"templates/email.MUSTACHE", "Handlebars/Mustache Escaping Boundaries"},
+		{"templates/account.jinja2", "Jinja Escaping Boundaries"},
+		{"templates/email.j2", "Jinja Escaping Boundaries"},
+		{"templates/account.JINJA2", "Jinja Escaping Boundaries"},
+		{"templates/email.J2", "Jinja Escaping Boundaries"},
 		{"src/main/resources/mapper/usermapper.xml", "SQL Logic Error Detection"},
 		{"src/main/resources/dao/userdao.xml", "SQL Logic Error Detection"},
 		{"pom.xml", "snapshot"},

pages/src/content/docs/en/review-rules.md

@@ -161,6 +161,7 @@ matching order:
 | `**/*.go` | `go.md` — Go source. |
 | `**/*.{ftl,ftlh,ftlx}` | `freemarker.md` — FreeMarker templates (SSTI / XSS / null handling). |
 | `**/*.{hbs,mustache}` | `handlebars_mustache.md` — Handlebars and Mustache templates. |
+| `**/*.{jinja2,j2}` | `jinja.md` — Jinja templates |
 | `**/*.ets` | `arkts.md` — ArkTS / HarmonyOS. |
 | `**/*.astro` | `astro.md` — Astro components and islands. |
 | `**/*.{ts,js,tsx,jsx}` | `ts_js_tsx_jsx.md` |

pages/src/content/docs/ja/review-rules.md

@@ -123,6 +123,7 @@ OCR は [`bmatcuk/doublestar/v4`](https://pkg.go.dev/github.com/bmatcuk/doublest
 | `**/*.go` | `go.md`: Go ソースコード。 |
 | `**/*.{ftl,ftlh,ftlx}` | `freemarker.md`: FreeMarker テンプレート（SSTI / XSS / null 処理）。 |
 | `**/*.{hbs,mustache}` | `handlebars_mustache.md`: Handlebars / Mustache テンプレート。 |
+| `**/*.{jinja2,j2}` | `jinja.md`: Jinja テンプレート |
 | `**/*.ets` | `arkts.md`: ArkTS / HarmonyOS。 |
 | `**/*.astro` | `astro.md`: Astro コンポーネントと islands。 |
 | `**/*.{ts,js,tsx,jsx}` | `ts_js_tsx_jsx.md` |

pages/src/content/docs/ko/review-rules.md

@@ -152,6 +152,7 @@ diff 단계에서 일어납니다.
 | `**/*.go` | `go.md` — Go 소스. |
 | `**/*.{ftl,ftlh,ftlx}` | `freemarker.md` — FreeMarker 템플릿(SSTI / XSS / null 처리). |
 | `**/*.{hbs,mustache}` | `handlebars_mustache.md` — Handlebars 및 Mustache 템플릿. |
+| `**/*.{jinja2,j2}` | `jinja.md` — Jinja 템플릿. |
 | `**/*.ets` | `arkts.md` — ArkTS / HarmonyOS. |
 | `**/*.astro` | `astro.md` — Astro 컴포넌트와 아일랜드. |
 | `**/*.{ts,js,tsx,jsx}` | `ts_js_tsx_jsx.md` |

pages/src/content/docs/ru/review-rules.md

@@ -163,6 +163,7 @@ OCR использует [`bmatcuk/doublestar/v4`](https://pkg.go.dev/github.com
 | `**/*.go` | `go.md` — исходный код Go. |
 | `**/*.{ftl,ftlh,ftlx}` | `freemarker.md` — шаблоны FreeMarker (SSTI / XSS / обработка null). |
 | `**/*.{hbs,mustache}` | `handlebars_mustache.md` — шаблоны Handlebars и Mustache. |
+| `**/*.{jinja2,j2}` | `jinja.md` — шаблоны Jinja |
 | `**/*.ets` | `arkts.md` — ArkTS / HarmonyOS. |
 | `**/*.astro` | `astro.md` — компоненты и islands Astro. |
 | `**/*.{ts,js,tsx,jsx}` | `ts_js_tsx_jsx.md` |

pages/src/content/docs/zh/review-rules.md

@@ -144,6 +144,7 @@ OCR 用 [`bmatcuk/doublestar/v4`](https://pkg.go.dev/github.com/bmatcuk/doublest
 | `**/*.go` | `go.md`——Go 源代码。 |
 | `**/*.{ftl,ftlh,ftlx}` | `freemarker.md`——FreeMarker 模板（SSTI / XSS / null 处理）。 |
 | `**/*.{hbs,mustache}` | `handlebars_mustache.md`——Handlebars 与 Mustache 模板。 |
+| `**/*.{jinja2,j2}` | `jinja.md`——Jinja 模板 |
 | `**/*.ets` | `arkts.md`——ArkTS / HarmonyOS。 |
 | `**/*.astro` | `astro.md`——Astro 组件与 islands。 |
 | `**/*.{ts,js,tsx,jsx}` | `ts_js_tsx_jsx.md` |