open-telemetry / open-telemetry/opentelemetry-python-contrib
Jinja2 templating with autoescape=False
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 1.1k
- Forks
- 1.1k
- Avg merge
- 4d 15h
- Merged PRs (30d)
- 16
Description
Cross-site scripting (XSS) attacks can occur if untrusted input is not escaped. This applies to templates as well as code. The jinja2 templates may be vulnerable to XSS if the environment has autoescape set to False. Unfortunately, jinja2 sets autoescape to False by default. Explicitly setting autoescape to True when creating an Environment object will prevent this.
instrumentation/opentelemetry-instrumentation-jinja2/tests/test_jinja2.py:146
def test_file_template_with_root(self):
with self.tracer.start_as_current_span("root"):
loader = jinja2.loaders.FileSystemLoader(TMPL_DIR)
env = jinja2.Environment(loader=loader)
References:
Jinja2: API.
Wikipedia: Cross-site scripting.
OWASP: XSS (Cross Site Scripting) Prevention Cheat Sheet.
Common Weakness Enumeration: CWE-79.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at instrumentation/opentelemetry-instrumentation-jinja2/tests/test_jinja2.py:146 and inspect how the Jinja2 Environment is configured in the surrounding tests. Determine whether the environment should explicitly enable autoescaping, then run the Jinja2 instrumentation tests; done means the relevant template environment no longer leaves autoescape disabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100