When a host pushes a CLR object into a Scriban TemplateContext via the standard, documented pattern —
var so = new ScriptObject();\nso[\"user\"] = currentUser; // direct CLR reference\ncontext.PushGlobal(so);\n— TypedObjectAccessor exposes every public-getter property for both reading and writing, and writes land on the live host object and persist after Render() returns. The write path performs no CanWrite and no setter-visibility check, producing two related but distinct weaknesses:
(A) Mass assignment of public setters — CWE-915 (originally F-002). Any { get; set; } property is writable from template code ({{ user.is_admin = true }}, {{ order.total_price = 0 }}). This is \"surprising but technically consistent with the setter being public\" — and crucially, Scriban offers no way to expose such a property read-only, because MemberFilter is read/write-symmetric.
(B) Access-modifier bypass — CWE-284 (originally F-007). Properties the developer deliberately restricted are also writable, because reflection ignores C# accessibility:
\n\nDeclaration | Developer intent | Actual behavior\n-- | -- | --\n{ get; set; } | writable | writable (mass assignment — A)\n{ get; private set; } | only the owning class writes | template writes freely\n{ get; internal set; } | only the declaring assembly writes | template writes freely\n{ get; init; } | immutable after construction (C# 9 language guarantee) | template writes freely post-construction\n\n\nThe init-only post-construction write — the highest false-positive risk — was explicitly confirmed against the shipped 7.2.1 package.
All releases that ship TypedObjectAccessor (<= 7.2.1). PrepareMembers has used the getter-only filter since the accessor was introduced, and TrySetValue has never checked the setter. The init bypass applies on .NET 5+; private set / internal set apply on every supported runtime. No patched version exists.
\n\nCopy-paste. Run from the engagement root (the folder containing both
\nscriban/andreports/).
Prereqs:
\ntest -d scriban || { echo \"scriban source missing\"; exit 1; }\n( command -v dotnet >/dev/null && dotnet --list-sdks | grep -q '^10\\.' ) \\\n || ( \"$HOME/.dotnet/dotnet\" --list-sdks | grep -q '^10\\.' ) \\\n || { echo \".NET 10 SDK missing\"; exit 1; }\nexport PATH=\"$HOME/.dotnet:$PATH\"\nRun both PoCs (native):
\n( cd reports/f002/poc && dotnet run -c Release ) # (A) public-setter mass assignment\n( cd reports/f007/poc && dotnet run -c Release ) # (B) private/internal/init bypass\nDocker fallback (no native SDK required):
\ndocker run --rm -v \"$PWD\":/work -w /work/reports/f007/poc \\\n mcr.microsoft.com/dotnet/sdk:10.0 bash -lc \"dotnet run -c Release\"\nConfirm the published package is affected (not just master): swap the ProjectReference in reports/f007/poc/poc.csproj for <PackageReference Include=\"Scriban\" Version=\"7.2.1\" /> and re-run — the four bypasses still succeed.
Each PoC prints [1] original CLR values, [2] template output (reads originals → writes → reads back), and [3] the C#-side read after Render() proving the live host object was permanently altered.
Fixes are listed flat. Note that (B) has a clean, clearly-correct code fix; (A) requires a new control because public-setter writes are otherwise by-design.
\nTrySetValue (TypedObjectAccessor.cs L108–L123). Fixes (B). Before the L120 SetValue, require a public, non-init setter:\nvar setM = propertyAccessor.GetSetMethod(nonPublic: false);\nif (setM is null) return false; // private / internal / protected setters\nif (setM.ReturnParameter.GetRequiredCustomModifiers()\n .Any(m => m.FullName == \"System.Runtime.CompilerServices.IsExternalInit\"))\n return false; // init-only: setter IS public, so the IsExternalInit check is REQUIRED\nGetSetMethod(nonPublic:false) != null check is not sufficient for init — the init setter is public; only the IsExternalInit modreq distinguishes it.MemberWriteFilter on TemplateContext (separate from MemberFilter) and/or a [ScriptMemberReadOnly] attribute, and split _members into _readableMembers / _writableMembers in PrepareMembers (L126–L186). Public-settable mass assignment cannot be blocked without one of these, because MemberFilter is read/write-symmetric today.ScriptObject.Import (ScriptObjectExtensions.cs L320–L324). Gate the Liquid-compatibility relaxation behind an explicit opt-in instead of removing write protection globally.site/docs/runtime/safe-runtime.md). State explicitly that templates can write CLR properties via reflection (including private/internal/init setters), and that MemberFilter does not separate read from write.src/Scriban.Tests/). Assert private set / internal set / init are non-writable from templates, that MemberWriteFilter / [ScriptMemberReadOnly] gate writes, and that only public set is writable.scriban/src/Scriban/Runtime/Accessors/TypedObjectAccessor.cs L108–L123 (TrySetValue), sink at L120 propertyAccessor.SetValue(target, context.ToObject(span, value, propertyAccessor.PropertyType));TypedObjectAccessor.cs L126–L186 (PrepareMembers), enumeration at L150, gate at L156; same _members consumed by TryGetValue (L66–L83)scriban/src/Scriban/ScribanAsync.generated.cs:2297 (accessor.TrySetValue(...)) and the synchronous evaluatorMemberFilter declared TemplateContext.cs:286, applied TemplateContext.cs:1026; ScriptObject.Import read-only removal ScriptObjectExtensions.cs:320–324init accessors (C# 9): https://learn.microsoft.com/dotnet/csharp/language-reference/proposals/csharp-9.0/init