Enable Jinja template auto-escape for any template

google / gae-secure-scaffold-python3

Secure scaffold for Google App Engine static and dynamic Python websites

Apache License 2.0

31 stars 16 forks source link

Enable Jinja template auto-escape for any template #26

Open davidwtbuxton opened 2 months ago

davidwtbuxton commented 2 months ago

We should enable Jinja's auto-escape behaviour for any file-based template. The default Flask behaviour applies escaping only for a few templates depending on the filename.

https://flask.palletsprojects.com/en/3.0.x/templating/#jinja-setup