autoescape=False
detected BAN-B70119 os.makedirs(user_guide_dir)
20
21 # Load the Jinja2 template for the user guide
22 env = Environment(loader=FileSystemLoader("templates"))23 user_guide_template = env.get_template("user_guide.md")
24
25 # Generate the user guide content
Using Jinja2 templates without autoescaping enabled leaves application vulnerable to [XSS attacks](https://owasp.org/www-project-top-ten/2017/A72017-Cross-SiteScripting_(XSS).
Autoescaping is the concept of automatically escaping special characters. Special characters for HTML, XML and XHTMl are &, >, <, " as well as '. These characters carry specific meanings so need to be replaced by so called entities
if you want to use them for text. Not doing so makes application susceptible to Cross Site Scripting (XSS) attacks.
When configuring the Jinja2 environment, the option to use autoescaping on input can be specified. By default, autoescaping is disabled. When enabled, Jinja2 will filter input strings to escape any HTML content submitted via template variables.
from jinja2 import Environment
template_env1 = Environment() # Insecure. Autoescape set to False by default
template_env2 = Environment(autoescape=False) # Insecure
from jinja2 import Environment
template_env = Environment(autoescape=True) # Secure