diff --git a/bandit/plugins/jinja2_templates.py b/bandit/plugins/jinja2_templates.py index f0b23e03b..667b79d62 100644 --- a/bandit/plugins/jinja2_templates.py +++ b/bandit/plugins/jinja2_templates.py @@ -104,9 +104,10 @@ def jinja2_autoescape_false(context): ): return # Check if select_autoescape function is used. - elif ( - isinstance(value, ast.Call) - and getattr(value.func, "id", None) + elif isinstance(value, ast.Call) and ( + getattr(value.func, "attr", None) + == "select_autoescape" + or getattr(value.func, "id", None) == "select_autoescape" ): return diff --git a/examples/jinja2_templating.py b/examples/jinja2_templating.py index d5aaa2dd5..0dce14d90 100644 --- a/examples/jinja2_templating.py +++ b/examples/jinja2_templating.py @@ -20,6 +20,9 @@ Environment(loader=templateLoader, autoescape=select_autoescape(['html', 'htm', 'xml'])) +Environment(loader=templateLoader, + autoescape=jinja2.select_autoescape(['html', 'htm', 'xml'])) + def fake_func(): return 'foobar'