markupsafe_markup_xss.py

import flask
from markupsafe import Markup, escape

content = "<script>alert('Hello, world!')</script>"
Markup(f"unsafe {content}")  # B704
flask.Markup("unsafe {}".format(content))  # B704
Markup("safe {}").format(content)
flask.Markup(b"safe {}", encoding='utf-8').format(content)
escape(content)
Markup(content)  # B704
flask.Markup("unsafe %s" % content)  # B704
Markup(object="safe")
Markup(object="unsafe {}".format(content))  # Not currently detected