Auto-escaping disabled (ARCH2134)

Key python.security.disabled-auto-escape · Severity warning · Category security · CWE CWE-79

Turning off auto-escaping in a template engine removes the default XSS protection for every rendered value. User data is emitted as raw HTML, opening the door to cross-site scripting.

Incorrect

from jinja2 import Environment, FileSystemLoader

env = Environment(loader=FileSystemLoader("templates"),
                  autoescape=False)

Correct

from jinja2 import Environment, FileSystemLoader, select_autoescape

env = Environment(loader=FileSystemLoader("templates"),
                  autoescape=select_autoescape(["html", "xml"]))

Fix

Keep auto-escaping on; use select_autoescape for HTML/XML templates.