Use jinja2 Sandbox instead of direct Template and enforce it (#727)

Author: haoranpb

pyproject.toml

@@ -87,6 +87,11 @@ ignore = [
     "TRY301",  # raise-within-try: suggested "abstract to inner function" refactor adds indirection
 ]
 
+[tool.ruff.lint.flake8-tidy-imports.banned-api]
+# Force sandboxed rendering:
+"jinja2.Template".msg = "Use jinja2.sandbox.SandboxedEnvironment instead; the bare Template is not sandboxed."
+"jinja2.Environment".msg = "Use jinja2.sandbox.SandboxedEnvironment instead; the bare Environment is not sandboxed."
+
 [tool.ruff.lint.per-file-ignores]
 "tests/**" = ["ANN"]
 "notebooks/**" = ["ANN", "T20"]   # notebooks routinely print() for analysis output

src/bcbench/agent/shared/mcp.py

@@ -4,7 +4,7 @@
 from pathlib import Path
 from typing import Any
 
-from jinja2 import Template
+from jinja2.sandbox import SandboxedEnvironment
 
 from bcbench.agent.shared.altool_paths import build_assembly_probing_paths, compiler_symbol_folder_for_container
 from bcbench.dataset import BaseDatasetEntry
@@ -13,6 +13,8 @@
 
 logger = get_logger(__name__)
 
+_jinja = SandboxedEnvironment(autoescape=False)
+
 
 def _build_server_entry(server: dict[str, Any], template_context: dict[str, Any]) -> tuple[str, dict[str, Any]]:
     server_type: str = server["type"]
@@ -26,7 +28,7 @@ def _build_server_entry(server: dict[str, Any], template_context: dict[str, Any]
             }
         case "stdio":
             args: list[str] = server["args"]
-            rendered_args = [Template(arg).render(**template_context) for arg in args]
+            rendered_args = [_jinja.from_string(arg).render(**template_context) for arg in args]
             command: str = shutil.which(server["command"]) or server["command"]
             entry: dict[str, Any] = {
                 "type": server_type,

src/bcbench/agent/shared/prompt.py

@@ -1,14 +1,16 @@
 import re
 from pathlib import Path
 
-from jinja2 import Template
+from jinja2.sandbox import SandboxedEnvironment
 
 from bcbench.config import get_config
 from bcbench.dataset import BaseDatasetEntry
 from bcbench.types import EvaluationCategory
 
 _config = get_config()
 
+_jinja = SandboxedEnvironment(autoescape=False)
+
 
 def _transform_image_paths(content: str) -> str:
     dest_dir = _config.file_patterns.problem_statement_dest_dir
@@ -26,8 +28,7 @@ def build_prompt(entry: BaseDatasetEntry, repo_path: Path, config: dict, categor
 
     task = _transform_image_paths(entry.get_task())
 
-    template = Template(template_str)
-    return template.render(
+    return _jinja.from_string(template_str).render(
         repo_path=repo_path,
         task=task,
         project_paths=", ".join(entry.project_paths),