>/iSrSSKrSSKrSSKJr SSKJr \R"S5\R"S5S55r g)aN ========================================== B701: Test for not auto escaping in jinja2 ========================================== Jinja2 is a Python HTML templating system. It is typically used to build web applications, though appears in other places well, notably the Ansible automation system. When configuring the Jinja2 environment, the option to use autoescaping on input can be specified. When autoescaping is enabled, Jinja2 will filter input strings to escape any HTML content submitted via template variables. Without escaping HTML input the application becomes vulnerable to Cross Site Scripting (XSS) attacks. Unfortunately, autoescaping is False by default. Thus this plugin test will warn on omission of an autoescape setting, as well as an explicit setting of false. A HIGH severity warning is generated in either of these scenarios. :Example: .. code-block:: none >> Issue: Using jinja2 templates with autoescape=False is dangerous and can lead to XSS. Use autoescape=True to mitigate XSS vulnerabilities. Severity: High Confidence: High CWE: CWE-94 (https://cwe.mitre.org/data/definitions/94.html) Location: ./examples/jinja2_templating.py:11 10 templateEnv = jinja2.Environment(autoescape=False, loader=templateLoader) 11 Environment(loader=templateLoader, 12 load=templateLoader, 13 autoescape=False) 14 >> Issue: By default, jinja2 sets autoescape to False. Consider using autoescape=True or use the select_autoescape function to mitigate XSS vulnerabilities. Severity: High Confidence: High CWE: CWE-94 (https://cwe.mitre.org/data/definitions/94.html) Location: ./examples/jinja2_templating.py:15 14 15 Environment(loader=templateLoader, 16 load=templateLoader) 17 18 Environment(autoescape=select_autoescape(['html', 'htm', 'xml']), 19 loader=templateLoader) .. seealso:: - `OWASP XSS `__ - https://realpython.com/primer-on-jinja-templating/ - https://jinja.palletsprojects.com/en/2.11.x/api/#autoescaping - https://security.openstack.org/guidelines/dg_cross-site-scripting-xss.html - https://cwe.mitre.org/data/definitions/94.html .. versionadded:: 0.10.0 .. versionchanged:: 1.7.3 CWE information added N)issue)test_propertiesCallB701c[UR[5(Ga<URRS5nUSnSU;GaUS:XGa [R "UR 5GHn[U[R5(dM%[USS5S:Xa[URSS5S:Xd[URS S5S LaM[R"[R[R[RRS S 9s $[USS5S:XdM[US S5n[USS5S :Xd[US S5SLa g[U[R 5(a8[UR"SS5S:Xd[UR"SS5S:Xa g[R"[R[R$[RRSS 9s $ [R"[R[R[RRSS 9$ggg)N.jinja2 Environmentarg autoescapeidFalsevalueFzUsing jinja2 templates with autoescape=False is dangerous and can lead to XSS. Use autoescape=True or use the select_autoescape function to mitigate XSS vulnerabilities.)severity confidencecwetextTrueTattrselect_autoescapezUsing jinja2 templates with autoescape=False is dangerous and can lead to XSS. Ensure autoescape=True or use the select_autoescape function to mitigate XSS vulnerabilities.zBy default, jinja2 sets autoescape to False. Consider using autoescape=True or use the select_autoescape function to mitigate XSS vulnerabilities.) isinstancecall_function_name_qualstrsplitastwalknodekeywordgetattrrbanditIssueHIGHrCweCODE_INJECTIONrfuncMEDIUM)context qualname_listr&rrs Y/home/james-whalen/.local/lib/python3.13/site-packages/bandit/plugins/jinja2_templates.pyjinja2_autoescape_falser+Is'1137777==cB R  } $)>.dCKK00tUD1\A D$77B"4::w=F%||%+[['-{{ % 8 8"/  tUD1\A 'gt <#E46&@&ugt<D"'sxx88#EJJ=23&uzz4>2 3##)<<)/+1==$)II$<$<&7 $ E/\<<!;;II,,<  _*? $8) __doc__rr! bandit.corerrtestcheckstest_idr+r,r*r3sG <z /Vf;;r,