User-generated Jinja 2 templates with Flask
If you allow users to upload arbitrary jinja2 templates, you allow them arbitrary html and javascript and thus become a web hosting company, with all the consequences.
You also have to be careful with the variables you give them access to, so that private user data (if any) is kept separated from each other.
I am writing a web application where users can create their own designs. The easiest way to do this would be by allowing them to upload their own Jinja 2 templates. However, I’m concerned about the security.
What are things I should be cautious for? Should I set a custom Jinja 2 environment for this?