Prevent setting arbitrary attrs on Jinja2 envs via overrides (#80715)

changelogs/fragments/no-arbitrary-j2-override.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - templating - prevent setting arbitrary attributes on Jinja2 environments via Jinja2 overrides in templates

lib/ansible/template/__init__.py

@@ -932,7 +932,10 @@ class Templar:
                                            " Did you use something different from colon as key-value separator?" % pair.strip())
                     (key, val) = pair.split(':', 1)
                     key = key.strip()
+                    if hasattr(myenv, key):
                         setattr(myenv, key, ast.literal_eval(val.strip()))
+                    else:
+                        display.warning(f"Could not find Jinja2 environment setting to override: '{key}'")
 
             if escape_backslashes:
                 # Allow users to specify backslashes in playbooks as "\\" instead of as "\\\\".