Disabled Auto Escape (ARCH8134)
Ce contenu n’est pas encore disponible dans votre langue.
Key kotlin.security.disabled-auto-escape · Severity warning · Category security · CWE CWE-79
Flags template engines configured with auto-escaping off (autoEscapingPolicy = DISABLE, escapeHtml = false, Pebble autoEscaping false).
Incorrect
Section titled “Incorrect”cfg.autoEscapingPolicy = Configuration.DISABLE_AUTO_ESCAPING_POLICYCorrect
Section titled “Correct”cfg.autoEscapingPolicy = Configuration.ENABLE_IF_DEFAULT_AUTO_ESCAPING_POLICYLeave auto-escaping on; mark trusted fragments explicitly.