Re: Should jinja2 run with autoescape set to true?

Ralf Schlatterbeck <[email protected]>
Newsgroups gmane.comp.bug-tracking.roundup.devel
Message-ID <[email protected]>
On Fri, Dec 27, 2019 at 09:34:25PM -0500, John P. Rouillard wrote:
> I am running bandit to look for possible security issues. It reports:
> 
>   roundup/cgi/engine_jinja2.py:47: B701[bandit]: HIGH: By default,
>     jinja2 sets autoescape to False. Consider using autoescape=True or
>     use the select_autoescape function to mitigate XSS vulnerabilities.

I've long suspected that the jinja templates don't correctly escape
things. If not done correctly we would have XSS issues.

One of the problems here is that we don't have *any* html rendering
tests afaik. Not for the traditional templates nor for jinja2.

A simple (non-automated) test would be to create an issue with a title
containing characters that should be escaped (<>&% etc) and check if they
are with jinja templates. If they are (without autoescape set),
autoescape will probably create double-escaped strings. But I fear that
they are not escaped.

Ralf
-- 
Dr. Ralf Schlatterbeck                  Tel:   +43/2243/26465-16
Open Source Consulting                  www:   http://www.runtux.com
Reichergasse 131, A-3411 Weidling       email: [email protected]
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.