SSTI Test Dataset
This dataset is for authorized security testing under the HuggingFace bug bounty program.
Template Injection Test Markers
Jinja2: {{77}}
Jinja2-expr: {{config}}
Jinja2-class: {{''.class.mro}}
Moustache: {{=77}}
Thymeleaf: ${77}
FreeMarker: ${77}
ERB: <%= 77 %>
Pebble: {{77}}
Twig: {{77}}
Velocity: #set($x=77)${x}
Smarty: {77}
Handlebars: {{{77}}}
Dollar-brace: ${77}
Hash: #{77}
Percent: <%=77%>
At: @(77)
Server-Side Include Test
Expression Language
${applicationScope}
${pageContext}
Python Format String
{0.class.mro}
