python.jinja2.security.audit.autoescape-disabled.autoescape-disabled

Verifed by r2c
Community Favorite
profile photo of returntocorpreturntocorp
Author
180,694
Download Count*
LGPL Commons Clause
License

Detected a Jinja2 environment without autoescaping. Jinja2 does not autoescape by default. This is dangerous if you are rendering to a browser because this allows for cross-site scripting (XSS) attacks. If you are in a web context, enable autoescaping by setting 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable automatic escaping for certain file extensions.

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: autoescape-disabled
    patterns:
      - pattern-not: jinja2.Environment(..., autoescape=True, ...)
      - pattern-not: jinja2.Environment(..., autoescape=jinja2.select_autoescape(...), ...)
      - pattern: jinja2.Environment(...)
    fix-regex:
      regex: (.*)\)
      replacement: \1, autoescape=True)
    message: Detected a Jinja2 environment without autoescaping. Jinja2 does not
      autoescape by default. This is dangerous if you are rendering to a browser
      because this allows for cross-site scripting (XSS) attacks. If you are in
      a web context, enable autoescaping by setting 'autoescape=True.' You may
      also consider using 'jinja2.select_autoescape()' to only enable automatic
      escaping for certain file extensions.
    metadata:
      source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b701_jinja2_autoescape_false.html
      cwe: "CWE-116: Improper Encoding or Escaping of Output"
      owasp: "A6: Security Misconfiguration"
      references:
        - https://jinja.palletsprojects.com/en/2.11.x/api/#basics
      category: security
      technology:
        - jinja2
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
    languages:
      - python
    severity: WARNING

Examples

autoescape-disabled.py

# cf. https://github.com/PyCQA/bandit/blob/02bad2e42311f420aef52dcd9806d66516ef594d/examples/jinja2_templating.py

import jinja2
from jinja2 import Environment, select_autoescape
templateLoader = jinja2.FileSystemLoader( searchpath="/" )
something = ''

# ok:autoescape-disabled
Environment(loader=templateLoader, load=templateLoader, autoescape=True)

# ok:autoescape-disabled
templateEnv = jinja2.Environment(autoescape=True,
        loader=templateLoader )

# ruleid:autoescape-disabled
Environment(loader=templateLoader, load=templateLoader, autoescape=something)


# ruleid:autoescape-disabled
templateEnv = jinja2.Environment(autoescape=False, loader=templateLoader )


# ruleid:autoescape-disabled
Environment(loader=templateLoader,
            load=templateLoader,
            autoescape=False)


# ruleid:autoescape-disabled
Environment(loader=templateLoader,
            load=templateLoader)

# ok:autoescape-disabled
Environment(loader=templateLoader, autoescape=select_autoescape())

# ok:autoescape-disabled
Environment(loader=templateLoader,
            autoescape=select_autoescape(['html', 'htm', 'xml']))


def fake_func():
    return 'foobar'


# ruleid:autoescape-disabled
Environment(loader=templateLoader, autoescape=fake_func())