Core: Allow list.append in Jinja2

[i00]

The problem

Using list.append causes an error:
SecurityError: access to attribute 'append' of 'list' object is unsafe.

Environment

• Home Assistant Core release with the issue: 0.107.7
• Last working Home Assistant Core release (if known): N/A
• Operating environment (Home Assistant/Supervised/Docker/venv): Docker
• Integration causing this issue: Templating?
• Link to integration documentation on our website: https://www.home-assistant.io/docs/configuration/templating/

Problem-relevant configuration.yaml

Jinja template:

{% set entities = [] %}
{% for state in states.cover %}
 {{ entities.append(state.entity_id) }}
{% endfor %}
{{ entities|join(',') }}

Traceback/Error logs

SecurityError: access to attribute 'append' of 'list' object is unsafe.

Additional information

I can understand why this could be a security issue if you could append to states.cover for example ... but for local variables??

I know there are workarounds like:

{%- set entities = namespace() %}
{%- set entities.entities = '' %}
{%- for state in states.cover -%}
  {%- if entities.entities != '' %}{% set entities.entities = entities.entities + ',' %}{%- endif %}
  {%- set entities.entities = entities.entities + state.entity_id %}
{%- endfor %}
{{- entities.entities }}

... but this is not as nice and somewhat tedious.

[probot-home-assistant[bot]]

Hey there @PhracturedBlue, @tetienne, mind taking a look at this issue as its been labeled with a integration (template) you are listed as a codeowner for? Thanks!

[gadgetchnnel]

A nicer workaround than the one above, which avoids the need for the string concatenation logic, is something like this:

{%- set data = namespace(entities=[]) -%}
{%- for state in states.cover -%}
{%- set data.entities = data.entities + [state.entity_id] -%}
{%- endfor -%}
{{ data.entities | join(",") }}

This relies on the fact that you can join two lists in Python by just doing list1 + list2, and I've actually used similar in some of my templates.

[ronytomen]

Also, you have to utilize namespace variables with in a loop, it's an odd Jinja requirement. I do not know if they consumer of Jinja (HA Core is the consumer here) can otherwise change this behavior.

[stale[bot]]

There hasn't been any activity on this issue recently. Due to the high number of incoming GitHub notifications, we have to clean some of the old issues, as many of them have already been resolved with the latest updates.
Please make sure to update to the latest Home Assistant version and check if that solves the issue. Let us know if that works for you by adding a comment 👍
This issue now has been marked as stale and will be closed if no further activity occurs. Thank you for your contributions.

[thomasvs]

Still a problem in the latest HA release, and I agree it doesn't make sense that you can't append to a local list inside a template.

[ronsum232]

Still the case in 117.0 with legacy_templates: false.

[frenck]

Just came by this. This is not a bug, but a feature. Home Assistant uses an immutable environment, prevent the use of these methods to protect the state engine.

This is not bug, but by design. Making this a feature request.

If you want to suggest a feature, you should try our Community Forum: Feature Requests.

Thanks! 👍