Skip to content

Rendering unescaped input in handlebar/mustache template can lead to XSS attacks - sdk-python #52

@zfarrell

Description

@zfarrell

Find more live information in Aikido here: https://app.aikido.dev/repositories/1742607?sidebarIssue=28016607&groupId=77741&sidebarIssueTask=4372533&sidebarTab=tasks

Scope

These issues affect the following code repository:

TLDR

Using {{{ }}} renders an unescaped string into the template. This means the developer is responsible for allowlisting all HTML strings that can be passed in.

How to fix

Avoid {{{ }}} usage. Ignore this issue only if the HTML content you feed into it is static. Defend in depth against XSS attacks by using a strict CSP policy. If you must use HTML, sanitize it with a library such as DOMPurify.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions