cherry pick CI changes and hist app #914
Conversation
* create a CLI for generating item.yaml and organize the CLI directory * modify comments to module * PR fixes * Update cli/common/generate_item_yaml.py Co-authored-by: Eyal Danieli <eyal_danieli@mckinsey.com> --------- Co-authored-by: Eyal Danieli <eyal_danieli@mckinsey.com>
…le) (#911) * histogram data drift module with empty example notebook * post review fixes
* fill data-drift nb * post review fixes
|
Check out this pull request on See visual diffs & provide feedback on Jupyter Notebooks. Powered by ReviewNB |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| } | ||
|
|
||
| # Load and render template | ||
| env = Environment(loader=FileSystemLoader(".")) |
Check warning
Code scanning / CodeQL
Jinja2 templating with autoescape=False Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 10 days ago
To fix the problem, we should pass a safe value for autoescape while creating the Jinja2 Environment. The most robust and future-proof way is to use Jinja2’s select_autoescape function, which will auto-enable escaping for html and xml templates, and otherwise leave it disabled (as is safe for YAML). This is the officially recommended approach and the least disruptive.
- Import
select_autoescapefrom Jinja2. - Change line 46 to:
env = Environment(loader=FileSystemLoader("."), autoescape=select_autoescape(['html', 'xml']))
No further changes are needed unless CLI generates HTML/XML templates in the future, in which case this configuration would protect those, too.
| @@ -2,7 +2,7 @@ | ||
| from pathlib import Path | ||
| from datetime import datetime | ||
| import click | ||
| from jinja2 import Environment, FileSystemLoader | ||
| from jinja2 import Environment, FileSystemLoader, select_autoescape | ||
|
|
||
| TEMPLATES = { | ||
| "function": "cli/utils/function_item_template.yaml.j2", | ||
| @@ -43,7 +43,7 @@ | ||
| } | ||
|
|
||
| # Load and render template | ||
| env = Environment(loader=FileSystemLoader(".")) | ||
| env = Environment(loader=FileSystemLoader("."), autoescape=select_autoescape(['html', 'xml'])) | ||
| template = env.get_template(TEMPLATES[type]) | ||
| rendered = template.render(params) | ||
|
|
No description provided.