Remove dangerous tpl funcs in Sprig that's enabled by default.

`env` and `expandenv` template functions in the Sprig library allow
accessing system environment variables within campaign templates.

Author: knadh

cmd/init.go

@@ -988,7 +988,11 @@ func initTplFuncs(i *i18n.I18n, u *UrlConfig) template.FuncMap {
 	}
 
 	// Copy spring functions.
-	maps.Copy(funcs, sprig.GenericFuncMap())
+	sprigFuncs := sprig.GenericFuncMap()
+	delete(sprigFuncs, "env")
+	delete(sprigFuncs, "expandenv")
+
+	maps.Copy(funcs, sprigFuncs)
 
 	return funcs
 }

internal/manager/manager.go

@@ -621,7 +621,11 @@ func (m *Manager) makeGnericFuncMap() template.FuncMap {
 	}
 
 	// Copy spring functions.
-	maps.Copy(funcs, sprig.GenericFuncMap())
+	sprigFuncs := sprig.GenericFuncMap()
+	delete(sprigFuncs, "env")
+	delete(sprigFuncs, "expandenv")
+
+	maps.Copy(funcs, sprigFuncs)
 
 	return funcs
 }