Skip to content

Commit

Permalink
add docs
Browse files Browse the repository at this point in the history
  • Loading branch information
clavedeluna committed Sep 27, 2023
1 parent c6478bf commit f909c5a
Show file tree
Hide file tree
Showing 2 changed files with 18 additions and 2 deletions.
17 changes: 17 additions & 0 deletions src/core_codemods/docs/pixee_python_enable-jinja2-autoescape.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
This codemod ensures you configure jinja2 to turn on autoescaping of HTML content. Unfortunately, the jinja2
default behavior is to not autoescape when rendering templates, which makes your applications
vulnerable to Cross-Site Scripting (XSS) attacks.

Our codemod currently checks if you forgot to turn autoescape on or if you explicitly disabled it. The change looks as follows:

```diff
from jinja2 import Environment

- env = Environment()
- env = Environment(autoescape=False, loader=some-loader)
+ env = Environment(autoescape=True)
+ env = Environment(autoescape=True, loader=some-loader)
...
```

At this time, this codemod will not detect if `autoescape` is assigned to a callable.
3 changes: 1 addition & 2 deletions tests/codemods/test_enable_jinja2_autoescape.py
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@
import pytest
from codemodder.codemods.enable_jinja2_autoescape import EnableJinja2Autoescape
from core_codemods.enable_jinja2_autoescape import EnableJinja2Autoescape
from tests.codemods.base_codemod_test import BaseSemgrepCodemodTest


Expand Down

0 comments on commit f909c5a

Please sign in to comment.