Should jinja2 run with autoescape set to true?

Hi all:

I have a question for Jinja2 experts (or at least more expert than me
which is just about everybody 8-)).

I am running bandit to look for possible security issues. It reports:

  roundup/cgi/engine_jinja2.py:47: B701[bandit]: HIGH: By default,
    jinja2 sets autoescape to False. Consider using autoescape=True or
    use the select_autoescape function to mitigate XSS vulnerabilities.

Does anybody know the implications for enabling autoescape? The test
suite doesn't test jinja2 templates at all. So I have no automated way
to tell if it breaks things.

I think all that is needed is to change:

  class Jinja2Loader(LoaderBase):
      def __init__(self, dir):
	  self._env = jinja2.Environment(
	      loader=jinja2.FileSystemLoader(dir),
	      extensions=[]
	  )
to

  class Jinja2Loader(LoaderBase):
      def __init__(self, dir):
	  self._env = jinja2.Environment(
	      loader=jinja2.FileSystemLoader(dir),
	      autoescape=True,
	      extensions=[]
	  )

For those using jinja2, can you test this and see if it works the same?

Does anybody think this should be an option in the tracker to turn
on/off with a default of off?

Thanks for any ideas.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.