XSS in jinja2 templates

freeipa / freeipa-community-portal

[ABANDONED] FreeIPA Community Portal extension

GNU General Public License v3.0

4 stars 6 forks source link

XSS in jinja2 templates #44

Open tiran opened 8 years ago

tiran commented 8 years ago

Michael Scherer has reported a XSS vulnerabilities in jinja2 templates. According to Michael jinja2 doesn't filter HTML. All user data (name, email etc) must be filtered.

mscherer commented 8 years ago

One solution would be autoescaping ( cf PR ), but the FAQ recommend against that: http://jinja.pocoo.org/docs/dev/faq/

simo5 commented 8 years ago

The reasons listged makes sense for applications that have a lot of program controlled output, but most of the portal has user controlled output, I think it is ok to use autoescaping to simplify the portal code.