Enable Jinja2 Autoescape

[pixeeai]

This codemod enables autoescaping of HTML content in jinja2. Unfortunately, the jinja2 default behavior is to not autoescape when rendering templates, which makes your applications potentially vulnerable to Cross-Site Scripting (XSS) attacks.

Our codemod checks if you forgot to enable autoescape or if you explicitly disabled it. The change looks as follows:

  from jinja2 import Environment

- env = Environment()
- env = Environment(autoescape=False, loader=some_loader)
+ env = Environment(autoescape=True)
+ env = Environment(autoescape=True, loader=some_loader)
  ...

More reading

• https://owasp.org/www-community/attacks/xss/
• https://jinja.palletsprojects.com/en/3.1.x/api/#autoescaping

I have additional improvements ready for this repo! If you want to see them, install our plugin (Github Marketplace download) & leave the comment:

@pixeebot next

... and I will open a new PR right away!

🧚🤖 Powered by Pixeebot

Feedback | Community | Docs | Codemod ID: pixee:python/enable-jinja2-autoescape