Jinja2 templating with autoescape=False

[rama280290]

Cross-site scripting (XSS) attacks can occur if untrusted input is not escaped. This applies to templates as well as code. The jinja2 templates may be vulnerable to XSS if the environment has autoescape set to False. Unfortunately, jinja2 sets autoescape to False by default. Explicitly setting autoescape to True when creating an Environment object will prevent this.

instrumentation/opentelemetry-instrumentation-jinja2/tests/test_jinja2.py:146

def test_file_template_with_root(self):
    with self.tracer.start_as_current_span("root"):
        loader = jinja2.loaders.FileSystemLoader(TMPL_DIR)
        env = jinja2.Environment(loader=loader)

References:

Jinja2: API. Wikipedia: Cross-site scripting. OWASP: XSS (Cross Site Scripting) Prevention Cheat Sheet. Common Weakness Enumeration: CWE-79.

[rama280290]

Will create PR for this one