title: Templating input into a yaml file - what sanitization do I need to do?
body: <p>I have a yaml file that I am generating via a templating language (in this case, jinja2.) Here's a trivial snippet:</p>
  
  <pre><code>services_to_install:
    {% for service in services if service.install -%}
    - {{ service.name }}
    {% endfor -%}
  user_data: |
    #! /bin/bash
    set -o errexit
    /usr/local/bin/ansible-playbook -i 127.0.0.1, -c local /tmp/ansible/playbook.yml --extra-vars 'app={{ app }}'
  </code></pre>
  
  <p>I know that, for instance, if I let <code>service.name</code> include a newline, it could escape out of the list it's supposed to be in and arbitrary yaml syntax could be written. So I am restricting newlines.</p>
  
  <p>However, I don't know all the other possible abuses for "code injection" (i.e. writing arbitrary yaml syntax) that could exist. Putting aside language specific tags that could create objects during runtime, what other things do I have to look out for?</p>
  
  <p>In other words, how do I sanitize input to a templated yaml file, much like one would sanitize input to a templated html file?</p>
  
  <p><em>p.s. I am not married to one templating engine or another, I am more interested in yaml syntax.</em></p>
  
  <p><strong>EDIT</strong> added a block element to my example since I also use those.</p>