Auto escape should be set to true
This product is not supported for your selected
Datadog site. (
).
이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.ID: python-security/jinja-autoescape
Language: Python
Severity: Notice
Category: Security
CWE: 94
Description
By default, jinja2 is not autoescaping. This can lead to XSS attacks. The autoescape parameter should always be True.
Learn More
Non-Compliant Code Examples
import jinja2
env = jinja2.Environment(
loader=PackageLoader("yourapp"),
autoescape=False # should be True
)
from jinja2 import Environment, PackageLoader, select_autoescape
env = Environment(
loader=PackageLoader("yourapp"),
autoescape=False # should be True
)
Compliant Code Examples
import jinja2
env = Environment(
loader=PackageLoader("yourapp"),
autoescape=True
)
from jinja2 import Environment, PackageLoader, select_autoescape
env = Environment(
loader=PackageLoader("yourapp"),
autoescape=select_autoescape()
)
from jinja2 import Environment, PackageLoader, select_autoescape
env = Environment(
loader=PackageLoader("yourapp"),
autoescape=True
)
원활한 통합. Datadog Code Security를 경험해 보세요
