def test_theme_template_disallow_loading_admin_templates():
    """Test that admin files in a theme will not be loaded"""
    app = create_ctfd()
    with app.app_context():
        try:
            # Make an empty malicious theme
            filename = os.path.join(
                app.root_path, "themes", "foo_disallow", "admin", "malicious.html"
            )
            os.makedirs(os.path.dirname(filename), exist_ok=True)
            set_config("ctf_theme", "foo_disallow")
            with open(filename, "w") as f:
                f.write("malicious")

            with pytest.raises(TemplateNotFound):
                render_template_string("{% include 'admin/malicious.html' %}")
        finally:
            # Remove empty theme
            shutil.rmtree(
                os.path.join(app.root_path, "themes", "foo_disallow"),
                ignore_errors=True,
            )
Test that admin files in a theme will not be loaded
tests/test_themes.py