search

Crown-Commercial-Service / govuk-frontend-jinja

Tools to use the GOV.UK Design System with Python webapps that use Jinja2 and Flask 🐍
MIT License
9 stars 6 forks source link

Enable autoescaping for Nunjucks templates #37

Closed lfdebrux closed 5 years ago

lfdebrux commented 5 years ago

Ticket: https://trello.com/c/isyW25Fl/63-enable-fix-autoescaping-for-nunjucks-macros-in-frontends

Also closes issue https://github.com/alphagov/govuk-frontend-jinja/issues/6

We want to make sure that input from users is made safe by being escaped; this PR enables autoescaping in the Flask extension by default, by overriding its default autoescape selector to also include njk files.

We also explicitly enable autoescaping for our tests, so we can feel sure that this change won't break everything.

lfdebrux commented 5 years ago

I tested this with https://github.com/alphagov/digitalmarketplace-brief-responses-frontend/pull/159 and I think it works, someone else should give it a go too though.

risicle commented 5 years ago

AH. It was being thrown by the file extension? Ha!