Disabled Auto Escape (ARCH4134)

Key java.security.disabled-auto-escape · Severity warning · Category security · CWE CWE-79

Turning off automatic HTML escaping in a template engine removes the default XSS protection for all rendered output. Keep auto-escaping on and opt into raw output only for trusted content.

Incorrect

Configuration cfg = new Configuration(Configuration.VERSION_2_3_32);
cfg.setOutputFormat(PlainTextOutputFormat.INSTANCE); // escaping off
Template t = cfg.getTemplate("profile.ftl");

Correct

Configuration cfg = new Configuration(Configuration.VERSION_2_3_32);
cfg.setOutputFormat(HTMLOutputFormat.INSTANCE); // auto HTML escaping
Template t = cfg.getTemplate("profile.ftl");

Fix

Keep automatic HTML escaping enabled in the template engine; use raw output only for trusted data.