From 2e6cd4f12b42fb5637d815f38ddf69dfbf16891f Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Mon, 7 Sep 2020 02:17:41 -0500 Subject: [PATCH] Optimize template sandbox for Home Assistant (#39731) --- homeassistant/helpers/template.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/homeassistant/helpers/template.py b/homeassistant/helpers/template.py index 405d8588532..ac326711581 100644 --- a/homeassistant/helpers/template.py +++ b/homeassistant/helpers/template.py @@ -1122,7 +1122,13 @@ class TemplateEnvironment(ImmutableSandboxedEnvironment): def is_safe_attribute(self, obj, attr, value): """Test if attribute is safe.""" - return isinstance(obj, Namespace) or super().is_safe_attribute(obj, attr, value) + if isinstance(obj, Namespace): + return True + + if isinstance(obj, (AllStates, DomainStates, TemplateState)): + return not attr.startswith("_") + + return super().is_safe_attribute(obj, attr, value) def compile(self, source, name=None, filename=None, raw=False, defer_init=False): """Compile the template."""