update DTL

content/docs/framework/ssti/django-template.md

@@ -21,7 +21,7 @@ Django ships built-in backends for its own template system, creatively called th
 
 Basic example of DTL:
 
-```html
+```jinja
 My first name is {{ first_name }}. My last name is {{ last_name }}.
 {{ my_dict.key }}
 {{ my_object.attribute }}
@@ -62,37 +62,43 @@ DTL vs Jinja2:
 
 ## Built-in
 
+- List of all tags and filters: [Django - Built-in template tags and filters](https://docs.djangoproject.com/en/5.0/ref/templates/builtins/)
+
 ### Debug
 
-```js
+```jinja
 {% debug %}
 ```
 
 ### CSRF
 
-```js
+```jinja
 {% csrf_token %}
 ```
 
 ### Secret Key Leak
 
 When `messages` is present in the template context and `CookieStorage` is being used we can walk through attributes of `messages` to access app's `SECRET_KEY`:
 
-```js
+```jinja
 {{ messages.storages.0.signer.key }}
 ```
 
-### Filters
+### Include Template
+
+You can include other templates in your page:
 
-List of all filters: [Built-in filter reference](https://docs.djangoproject.com/en/5.0/ref/templates/builtins/#built-in-filter-reference)
+```jinja
+{% include 'admin/base.html' %}
+```
 
 ### XSS
 
 - `safe`: Marks a string as not requiring further HTML escaping prior to output. When autoescaping is off, this filter has no effect.
 - `escape`: Escapes a string's HTML (HTML entity).
 - `force_escape`: Applies HTML escaping to a string.
 
-```html
+```jinja
 {% autoescape off %}
     {{ message }}
 {% endautoescape %}

hugo_stats.json

@@ -381,6 +381,7 @@
       "http",
       "httponly",
       "in-scope",
+      "include-template",
       "infinite-levels-deep",
       "information-leakage",
       "innerhtml-vs-innertext",