Merge branch 'kvakil-kvakil-xss'

* kvakil-kvakil-xss: fixed cross-site scripting attack
okpy · Oct 5, 2016 · c6c0e67 · c6c0e67
2 parents 9a7b112 + 9db2dc6
commit c6c0e67
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/server/__init__.py b/server/__init__.py
@@ -8,6 +8,7 @@
 from flask_wtf.csrf import CsrfProtect
 from webassets.loaders import PythonLoader as PythonAssetsLoader
 from werkzeug.contrib.fixers import ProxyFix
+from jinja2 import escape
 
 from server import assets, converters, utils
 from server.forms import CSRFForm
@@ -108,7 +109,7 @@ def not_found_error(error):
     })
 
     app.jinja_env.filters.update({
-        'markdown': lambda data: Markup(markdown(data)),
+        'markdown': lambda data: Markup(markdown(escape(data))),
         'pluralize': utils.pluralize
     })