Re: Should jinja2 run with autoescape set to true?
Ralf Schlatterbeck <[email protected]>
| Newsgroups | gmane.comp.bug-tracking.roundup.devel |
|---|---|
| Message-ID | <[email protected]> |
On Fri, Dec 27, 2019 at 09:34:25PM -0500, John P. Rouillard wrote: > I am running bandit to look for possible security issues. It reports: > > roundup/cgi/engine_jinja2.py:47: B701[bandit]: HIGH: By default, > jinja2 sets autoescape to False. Consider using autoescape=True or > use the select_autoescape function to mitigate XSS vulnerabilities. I've long suspected that the jinja templates don't correctly escape things. If not done correctly we would have XSS issues. One of the problems here is that we don't have *any* html rendering tests afaik. Not for the traditional templates nor for jinja2. A simple (non-automated) test would be to create an issue with a title containing characters that should be escaped (<>&% etc) and check if they are with jinja templates. If they are (without autoescape set), autoescape will probably create double-escaped strings. But I fear that they are not escaped. Ralf -- Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16 Open Source Consulting www: http://www.runtux.com Reichergasse 131, A-3411 Weidling email: [email protected]