Autoescape jinja templates

General security best practice. It's usually for avoiding XSS attacks, which aren't relevant here. But, why not enable it anyways?
yrodiere · Jul 25, 2024 · 53572de · 53572de
1 parent f3c4aa7
commit 53572de
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/sync2jira/downstream_issue.py b/sync2jira/downstream_issue.py
@@ -285,7 +285,7 @@ def alert_user_of_duplicate_issues(issue, final_result, results_of_query,
     # Create and send email
     templateLoader = jinja2.FileSystemLoader(
         searchpath='usr/local/src/sync2jira/sync2jira/')
-    templateEnv = jinja2.Environment(loader=templateLoader)
+    templateEnv = jinja2.Environment(loader=templateLoader, autoescape=True)
     template = templateEnv.get_template('email_template.jinja')
     html_text = template.render(user=user,
                                 admins=admin_template,

diff --git a/sync2jira/main.py b/sync2jira/main.py
@@ -461,7 +461,7 @@ def report_failure(config):
     # Email our admins with the traceback
     templateLoader = jinja2.FileSystemLoader(
         searchpath='usr/local/src/sync2jira/sync2jira/')
-    templateEnv = jinja2.Environment(loader=templateLoader)
+    templateEnv = jinja2.Environment(loader=templateLoader, autoescape=True)
     template = templateEnv.get_template('failure_template.jinja')
     html_text = template.render(traceback=traceback.format_exc())