Server-side template injection and expression evaluation

Mechanism

Template injection occurs when untrusted input becomes template source rather than a value supplied to a fixed template. Expression evaluation is the initial primitive; file access or command execution depends on the engine, exposed objects, extensions, and sandbox policy. Client-side template behavior and ordinary string formatting can resemble the same symptom while crossing different boundaries.

Practical method

Use a small arithmetic expression in a harmless lab field and compare it with escaped literal text. Observe error syntax to narrow the engine family, then verify with a second independent expression. Separate engine identification from capability exploration. List available context objects and filters before assuming a known object traversal path remains valid on the deployed version.

# Data should enter a fixed template as a variable.
render_template("greeting.html", name=user_name)
# Building template source with user_name creates a new grammar boundary.

Interpreting evidence

An evaluated arithmetic result establishes template interpretation only if the original value is not otherwise transformed by application code. Retain the raw request, error message, and exact rendered output to show which layer processed the expression.

Pitfalls and limits

Engine syntax overlaps. A sandbox escape described for one release may have been removed. A template can have safe expression evaluation while still exposing an unsafe helper; treat those as separate findings.