From 40bff49815c121551834ce5535d328d16f419ed4 Mon Sep 17 00:00:00 2001
From: Miguel Jacq <mig@mig5.net>
Date: Thu, 2 Jul 2026 14:52:20 +1000
Subject: [PATCH] Forbid the ansible globals

---
 enroll/jinjaturtle.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/enroll/jinjaturtle.py b/enroll/jinjaturtle.py
index dd69121..1f9248e 100644
--- a/enroll/jinjaturtle.py
+++ b/enroll/jinjaturtle.py
@@ -137,6 +137,13 @@ _JINJA_BUILTIN_GLOBAL_NAMES = frozenset(
         "config",
         "self",
         "cycle",
+        # Ansible global set
+        "lookup",
+        "q",
+        "query",
+        "now",
+        "omit",
+        "undef",
     }
 )