Disabled auto-escape (ARCH3134)

Key typescript.security.disabled-auto-escape · Severity warning · Category security · CWE CWE-79

Turning off auto-escaping in a template engine removes the default XSS protection for all rendered output. Keep auto-escaping on and mark only known-safe content.

Incorrect

import nunjucks from "nunjucks";

const env = nunjucks.configure("views", { autoescape: false });
res.send(env.render("profile.njk", { bio: req.body.bio }));

Correct

import nunjucks from "nunjucks";

const env = nunjucks.configure("views", { autoescape: true });
res.send(env.render("profile.njk", { bio: req.body.bio }));

Fix

Leave autoescape: true on the template engine; only explicitly mark sanitized content when raw HTML is required.