Yi Liu 6a07b3acda fix(core): correct misleading jinja2 sandboxing comment (#35183) ...

## Summary
- The inline comment at `langchain_core/prompts/string.py:67-69`
incorrectly states that `SandboxedEnvironment` "blocks ALL
attribute/method access" and that "only simple variable lookups like
`{{variable}}` are allowed."
- In reality, Jinja2's `SandboxedEnvironment` only blocks access to
dunder attributes (`__class__`, `__globals__`, etc.) to prevent sandbox
escapes. Regular attribute access like `{{obj.content}}` and method
calls remain allowed.
- This misleading comment was left behind when a
`_RestrictedSandboxedEnvironment` class was reverted in commit
395c8d0bd4. Updated to accurately describe the actual behavior.

## Why this matters
The comment could mislead developers into trusting partially-untrusted
templates, believing attribute access is blocked when it is not. The
function's docstring already correctly warns against untrusted
templates.

## Test plan
- [ ] No behavioral change — comment-only fix
- [ ] Verified `SandboxedEnvironment` behavior matches updated comment

> This PR was authored with the help of AI tools.

2026-02-16 23:17:22 -05:00

..

__init__.py

style(core): lint (#34862)

2026-01-23 23:07:48 -05:00

base.py

style(core): lint (#34862)

2026-01-23 23:07:48 -05:00

chat.py

style: bump ruff version to 0.15 (#35042)

2026-02-12 19:34:02 -05:00

dict.py

style(core): lint (#34862)

2026-01-23 23:07:48 -05:00

few_shot_with_templates.py

style(core): lint (#34862)

2026-01-23 23:07:48 -05:00

few_shot.py

style(core): lint (#34862)

2026-01-23 23:07:48 -05:00

image.py

style(core): lint (#34862)

2026-01-23 23:07:48 -05:00

loading.py

style: bump ruff version to 0.15 (#35042)

2026-02-12 19:34:02 -05:00

message.py

style(core): lint (#34862)

2026-01-23 23:07:48 -05:00

prompt.py

style(core): lint (#34862)

2026-01-23 23:07:48 -05:00

string.py

fix(core): correct misleading jinja2 sandboxing comment (#35183)

2026-02-16 23:17:22 -05:00

structured.py

style(core): lint (#34862)

2026-01-23 23:07:48 -05:00