Cross-site scripting (ARCH2101)

Key python.security.xss · Severity error · Category security · CWE CWE-79

Writing untrusted data to HTML output without escaping lets an attacker run scripts in the browser. Avoid disabling auto-escaping.

Incorrect

from flask import request
from markupsafe import Markup

def render_comment():
    comment = request.args.get("c", "")
    return Markup("<p>%s</p>" % comment)

Correct

from flask import request, escape

def render_comment():
    comment = request.args.get("c", "")
    return "<p>%s</p>" % escape(comment)

Fix

Escape user input before writing it to output and never disable the template engine’s auto-escaping.