XSS vulnerable

[adamchainz]

The code in renderers.py uses f-strings to template HTML with HTML-escaping incoming strings. This means user content being used in a response could be reflected and rendered in the browser.

[danjac]

Good point, let's fix that.

[adamchainz]

You can do this by rendering via Django templates, jinja2, or html.escape().

[danjac]

The TurboStream and TurboFrame classes already have template classes/methods for handling template-based content, so you would likely do something like:

TurboStream("target").append.template("tmpl.html", {}).render()

So rendering in such cases is fine, as the HTML string is already handled with a Django templates. In such cases we can pass this content through mark_safe as it can be assumed to have already been handled by the Django template engine.

[danjac]

Fixed in 0.0.39.