openstack/trove
Code Issues Proposed changes

Add jinja2 autoescape=True

Browse Source 
For avoiding XSS vulnerabilities, bandit suggests to set
autoescape=True.

After this change the bandit issues no longer appears.

Change-Id: Ic47dadef49b4504b3bcfbdc63ea85c937aabf334
Closes-Bug: #1663417
This commit is contained in:
Trevor McCasland 2017-04-06 09:03:10 -05:00
parent 03091f1c58
commit a173923ed5
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
trove/common/utils.py
View File

@ -50,10 +50,12 @@ isotime = timeutils.isotime
def build_jinja_environment():
env = jinja2.Environment(loader=jinja2.ChoiceLoader([
jinja2.FileSystemLoader(CONF.template_path),
jinja2.PackageLoader("trove", "templates")
]))
env = jinja2.Environment(
autoescape=True,
loader=jinja2.ChoiceLoader([
jinja2.FileSystemLoader(CONF.template_path),
jinja2.PackageLoader("trove", "templates")
]))
# Add some basic operation not built-in.
env.globals['max'] = max
env.globals['min'] = min