From 8dc9f5b5d6c4557f46ff79e6ace43bc08a5fe287 Mon Sep 17 00:00:00 2001
From: Hugo <hugo.payet@epitech.eu>
Date: Thu, 24 Sep 2026 23:10:58 +0200
Subject: [PATCH 1/2] test: specify when Django templates escape what
 render_to_string returns

---
 tests/test_template_escaping.py | 178 ++++++++++++++++++++++++++++++++
 1 file changed, 178 insertions(+)
 create mode 100644 tests/test_template_escaping.py

diff --git a/tests/test_template_escaping.py b/tests/test_template_escaping.py
new file mode 100644
index 0000000..7cea9da
--- /dev/null
+++ b/tests/test_template_escaping.py
@@ -0,0 +1,178 @@
+"""Django templates escape what they render, where the engine can establish it.
+
+``render_to_string(name, context)`` returns HTML in which autoescaping has escaped every
+variable, so attacker data reaching ``HttpResponse`` through it is no cross-site
+scripting, provided the template really escapes. The engine establishes that only when
+all of these hold:
+
+- it finds every template of that name under a ``templates`` directory, and everything
+  those templates extend or include;
+- none of them marks output safe (``|safe``, ``|safeseq``, ``{% autoescape off %}``);
+- none uses a tag beyond Django's own, or loads a tag library beyond its built-ins;
+- none places a variable where HTML escaping does not protect it: a ``<script>`` or
+  ``<style>`` block, an event handler, a ``style`` attribute, a URL attribute not fixed
+  by a relative or ``http(s)`` prefix, an unquoted attribute, or an attribute name;
+- no settings turn autoescaping off.
+
+Otherwise the flow is reported as before. A template the engine cannot read, such as one
+under a ``DIRS`` entry that is not a ``templates`` directory, is not assumed safe.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from coretrace_python import engine
+from coretrace_python.cache import ProjectCache
+from coretrace_python.source import SourceManager
+from coretrace_python.taint.templates import escaped_templates
+
+VIEW = (
+    "from django.http import HttpRequest, HttpResponse\n"
+    "from django.template.loader import render_to_string\n\n"
+    "def page(request: HttpRequest):\n"
+    "    return HttpResponse(render_to_string({name}, {{'name': request.GET['name']}}))\n"
+)
+
+
+def write(root: Path, files: dict[str, str]) -> Path:
+    for relative, text in files.items():
+        path = root / relative
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(text, encoding="utf-8")
+    return root
+
+
+def xss(root: Path, template: str, name: str = "'app/page.html'", files: dict[str, str] | None = None) -> list[int]:
+    write(root, {"app/views.py": VIEW.format(name=name), "app/templates/app/page.html": template, **(files or {})})
+    findings = engine.analyze_project(root, [engine.BUNDLED_PLUGINS]).findings
+    return [f.span.start_line for f in findings if f.rule_id == "xss"]
+
+
+# --------------------------------------------------------------------------- inspection
+
+
+def test_a_template_escaping_every_variable_in_text_and_quoted_attributes_is_escaped(tmp_path: Path) -> None:
+    template = (
+        "{% load static i18n %}<p title=\"{{ name }}\">{% trans 'Hello' %} {{ name|upper }}</p>\n"
+        "<a href=\"/users/{{ name }}/\">{{ name }}</a> <a href='https://example.com/?q={{ name }}'>x</a>\n"
+        "<img src=\"{% static 'logo.png' %}\" alt=\"{{ name }}\"><!-- {{ name }} -->\n"
+        "{% for item in items %}{{ item }}{% empty %}-{% endfor %}{% comment %}{{ x|safe }}{% endcomment %}"
+    )
+
+    assert escaped_templates(write(tmp_path, {"app/templates/app/page.html": template})) == {"app/page.html"}
+
+
+@pytest.mark.parametrize(
+    "template",
+    [
+        "{{ name|safe }}",
+        "{{ items|safeseq|join:', ' }}",
+        "{% autoescape off %}{{ name }}{% endautoescape %}",
+        "<script>var n = '{{ name }}';</script>",
+        "<style>p { color: {{ color }} }</style>",
+        "<a href=\"{{ url }}\">x</a>",
+        "<a href=\"javascript:go('{{ name }}')\">x</a>",
+        "<div onclick=\"go('{{ name }}')\">x</div>",
+        "<div style=\"width: {{ width }}\">x</div>",
+        "<div title={{ name }}>x</div>",
+        "<div {{ attributes }}>x</div>",
+        "{% load custom_tags %}<p>{{ name }}</p>",
+        "{% custom_tag name %}",
+        "{% include template_name %}",
+        "{% extends base_name %}",
+        "{% include 'app/missing.html' %}",
+    ],
+)
+def test_a_template_that_may_output_unescaped_data_is_not_escaped(tmp_path: Path, template: str) -> None:
+    assert escaped_templates(write(tmp_path, {"app/templates/app/page.html": template})) == frozenset()
+
+
+def test_a_template_escapes_no_better_than_what_it_extends_and_includes(tmp_path: Path) -> None:
+    files = {
+        "app/templates/base.html": (
+            "{% load static %}<html><body>{% block content %}{% endblock %}"
+            "<script src=\"{% static 'app.js' %}\"></script></body></html>"
+        ),
+        "app/templates/app/page.html": (
+            "{% extends 'base.html' %}{% block content %}<p>{{ name }}</p>{% include 'app/part.html' %}{% endblock %}"
+        ),
+        "app/templates/app/part.html": "<span>{{ name }}</span>",
+        "app/templates/raw.html": "{% block content %}{% endblock %}<p>{{ name|safe }}</p>",
+        "app/templates/app/on_raw.html": "{% extends 'raw.html' %}{% block content %}{{ name }}{% endblock %}",
+    }
+
+    assert escaped_templates(write(tmp_path, files)) == {"base.html", "app/page.html", "app/part.html"}
+
+
+def test_every_template_of_a_name_must_escape(tmp_path: Path) -> None:
+    files = {"one/templates/page.html": "<p>{{ name }}</p>", "two/templates/page.html": "<p>{{ name|safe }}</p>"}
+
+    assert escaped_templates(write(tmp_path, files)) == frozenset()
+
+
+def test_settings_disabling_autoescape_leave_no_template_escaped(tmp_path: Path) -> None:
+    files = {
+        "app/templates/app/page.html": "<p>{{ name }}</p>",
+        "site/settings.py": "TEMPLATES = [{'BACKEND': 'x', 'OPTIONS': {'autoescape': False}}]\n",
+    }
+
+    assert escaped_templates(write(tmp_path, files)) == frozenset()
+
+
+# --------------------------------------------------------------------------- analysis
+
+
+def test_rendering_an_escaped_template_is_not_cross_site_scripting(tmp_path: Path) -> None:
+    assert xss(tmp_path, "<p>Hello {{ name }}</p>") == []
+
+
+def test_rendering_a_template_that_marks_the_value_safe_stays_cross_site_scripting(tmp_path: Path) -> None:
+    assert xss(tmp_path, "<p>Hello {{ name|safe }}</p>") == [5]
+
+
+def test_a_template_named_by_an_expression_stays_cross_site_scripting(tmp_path: Path) -> None:
+    assert xss(tmp_path, "<p>Hello {{ name }}</p>", name="'app/' + 'page.html'") == [5]
+
+
+def test_a_template_outside_a_templates_directory_is_not_assumed_escaped(tmp_path: Path) -> None:
+    # Django finds it through a DIRS entry the engine does not read: a known limitation.
+    view = VIEW.format(name="'page.html'")
+    write(tmp_path, {"app/views.py": view, "frontend/page.html": "<p>Hello {{ name }}</p>"})
+
+    findings = engine.analyze_project(tmp_path, [engine.BUNDLED_PLUGINS]).findings
+
+    assert [f.span.start_line for f in findings if f.rule_id == "xss"] == [5]
+
+
+def test_a_single_file_check_assumes_no_template_escaped() -> None:
+    findings = engine.check(
+        SourceManager().add_source("views.py", VIEW.format(name="'app/page.html'")), [engine.BUNDLED_PLUGINS]
+    )
+
+    assert [f.rule_id for f in findings] == ["xss"]
+
+
+def test_a_template_gaining_safe_invalidates_the_cached_results(tmp_path: Path) -> None:
+    cache = ProjectCache(tmp_path / "cache")
+    root = write(tmp_path / "src", {"app/views.py": VIEW.format(name="'app/page.html'")})
+    page = write(root, {"app/templates/app/page.html": "<p>{{ name }}</p>"}) / "app/templates/app/page.html"
+
+    first = engine.analyze_project(root, [engine.BUNDLED_PLUGINS], cache=cache)
+    page.write_text("<p>{{ name|safe }}</p>", encoding="utf-8")
+    second = engine.analyze_project(root, [engine.BUNDLED_PLUGINS], cache=cache)
+
+    assert [f.rule_id for f in first.findings if f.rule_id == "xss"] == []
+    assert second.reused == ()
+    assert [f.span.start_line for f in second.findings if f.rule_id == "xss"] == [5]
+
+
+def test_modules_analysed_in_other_processes_see_the_escaped_templates(tmp_path: Path) -> None:
+    root = write(tmp_path, {"app/views.py": VIEW.format(name="'app/page.html'"), "app/other.py": "X = 1\n"})
+    write(root, {"app/templates/app/page.html": "<p>{{ name }}</p>"})
+
+    findings = engine.analyze_project(root, [engine.BUNDLED_PLUGINS], jobs=2).findings
+
+    assert [f.rule_id for f in findings if f.rule_id == "xss"] == []

From 4d054a62847db750f90e440cc53fd76f905506eb Mon Sep 17 00:00:00 2001
From: Hugo <hugo.payet@epitech.eu>
Date: Thu, 24 Sep 2026 23:10:59 +0200
Subject: [PATCH 2/2] fix: clear render_to_string output only for templates
 shown to escape

---
 CHANGELOG.md                                  |   6 +
 docs/plugins.md                               |   1 +
 docs/usage.md                                 |  25 +-
 .../bundled/models/django/django_models.py    |   2 +
 src/coretrace_python/engine.py                |  21 +-
 src/coretrace_python/taint/__init__.py        |   5 +
 src/coretrace_python/taint/engine.py          |  19 +-
 src/coretrace_python/taint/models.py          |  20 ++
 src/coretrace_python/taint/templates.py       | 250 ++++++++++++++++++
 tests/regression/expected/pygoat.json         |  18 --
 10 files changed, 345 insertions(+), 22 deletions(-)
 create mode 100644 src/coretrace_python/taint/templates.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 07e1a63..c921065 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## Unreleased
+
+### Precision
+
+- `render_to_string` escapes what it renders where the analyzer can establish it: on a directory check, it reads the project's Django templates, and a template escapes when neither it nor what it extends or includes marks output safe, uses a tag, filter or library beyond Django's own, or prints a variable where HTML escaping does not protect it, and no settings turn autoescaping off. Data reaching a response through such a template is no longer `xss`; any other template keeps the flow reported. `TemplateRender` declares such rendering calls, and the escaped templates are part of the cache key (#130).
+
 ## 0.6.0 (2026-09-24)
 
 ### Reports
diff --git a/docs/plugins.md b/docs/plugins.md
index e766074..1df0cc6 100644
--- a/docs/plugins.md
+++ b/docs/plugins.md
@@ -149,6 +149,7 @@ class BottleModels(ModelPlugin):
 | `RouteRegistrar(symbol, argument, label, kinds=ALL, keyword=None)` | A call registering a view at argument `argument` (or `keyword`), such as Django's `path`; the view receives `label` input. |
 | `SuffixSink(suffix, kinds, positions=())` | A sink matched by the end of the symbol, for methods of any class such as `objects.raw`. |
 | `SafeArgument(symbol, argument, values, position=None, kinds=ALL)` | A call to the sink `symbol` whose `argument` (by keyword, or at `position`) denotes one of `values` is not a sink for `kinds`, such as `yaml.load` with `Loader=yaml.SafeLoader`. Values are written as the analyzer records arguments: a symbol by its canonical name, a constant as Python writes it (`True`). Only a value given explicitly makes the call safe. |
+| `TemplateRender(symbol, position=0, keyword="template_name")` | A call rendering, with autoescaping, the template named by its argument at `position` or `keyword`, such as `render_to_string`. What it returns carries no `HTML` when the name is written in the call and the project's template escapes everything it prints (see the usage guide). |
 | `Validator(symbol, kinds=ALL, argument=0)` | A callable whose truth proves its argument safe, such as `re.fullmatch`; a flow guarded by it is refuted. |
 | `AuthorizationGuard(symbol, label)` | A decorator or a condition restricting who reaches the code, such as `login_required`; a flow behind it is a hotspot. |
 
diff --git a/docs/usage.md b/docs/usage.md
index c749c6c..6f35bd7 100644
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -109,7 +109,7 @@ a sanitizer for that kind of sink.
 | `sql-injection` | A database statement (`cursor.execute`, SQLAlchemy `text`, Django `raw`, …). Parameters of a parameterised query are not statements. |
 | `path-traversal` | A file system path (`open`, `send_file`, `os.remove`, …). |
 | `ssrf` | The URL of an HTTP client request (Requests, httpx, `urllib`). |
-| `xss` | An HTTP response body built without escaping. |
+| `xss` | An HTTP response body built without escaping. A Django template rendered by `render_to_string` escapes, where the analyzer can establish it (below). |
 | `insecure-deserialization` | `pickle`, `marshal`, `dill`, `jsonpickle`, `shelve`, and the YAML loaders (`yaml.load`, `load_all`, `full_load`, `unsafe_load` and their several-document versions); `yaml.load` and `load_all` given a safe loader (`SafeLoader`, `BaseLoader`) are not. |
 | `open-redirect` | An HTTP redirect target. |
 | `plaintext-credential-storage` | A parameter named like a password stored in a database without hashing. Medium confidence, since a name is a hint. |
@@ -122,6 +122,29 @@ numeric value proven by `int()`, `len()` or bounded arithmetic, a validator such
 or an authorization decorator such as `login_required`, makes it a hotspot reported at
 medium confidence. The verdict and its evidence are in the finding's metadata.
 
+Django's `render_to_string(name, context)` returns HTML in which autoescaping escaped
+every variable, so data reaching a response through it is no `xss`, if the template really
+escapes. On a directory check, the analyzer reads the project's templates to decide it.
+
+It establishes escaping only when all of the following hold:
+
+- It finds every template of that name under a `templates` directory, by the path Django
+  uses (`app/page.html`), and everything those templates extend or include.
+- None of them marks output safe: `|safe`, `|safeseq` or `{% autoescape off %}`.
+- None of them uses a tag or filter beyond Django's own, or loads a library beyond its
+  built-ins (`static`, `i18n`, `l10n`, `tz`, `cache`, `humanize`).
+- None of them places a variable where HTML escaping does not protect it: a `<script>`
+  or `<style>` block, an event handler (`onclick="…"`), a `style` attribute, a URL
+  attribute not fixed by a relative or `http(s)://host/` prefix, an unquoted attribute,
+  or an attribute name.
+- No Python file of the project sets `autoescape` to `False`.
+
+The analyzer never assumes escaping where it cannot read the template. That covers a
+template named by an expression, a template found through a `DIRS` entry not named
+`templates`, one shipped by an installed package, one rendered through `get_template`,
+and Flask's Jinja2 templates. The flow is then reported as before. A single-file check
+reads no template.
+
 ### Dangerous API usage
 
 | Rule | Reported call |
diff --git a/src/coretrace_python/bundled/models/django/django_models.py b/src/coretrace_python/bundled/models/django/django_models.py
index 060b346..63a8fc2 100644
--- a/src/coretrace_python/bundled/models/django/django_models.py
+++ b/src/coretrace_python/bundled/models/django/django_models.py
@@ -23,6 +23,7 @@
     Source,
     SuffixSink,
     TaintKind,
+    TemplateRender,
     TypedParameter,
 )
 
@@ -119,6 +120,7 @@ class DjangoModels(ModelPlugin):
         Sink(_sym("django.http.HttpResponseRedirect"), TaintKind.REDIRECT, _TARGET_ONLY),
         Sink(_sym("django.http.HttpResponsePermanentRedirect"), TaintKind.REDIRECT, _TARGET_ONLY),
         Sanitizer(_sym("django.utils.html.escape"), TaintKind.HTML),
+        TemplateRender(_sym("django.template.loader.render_to_string")),
         Sanitizer(_sym("django.utils.html.conditional_escape"), TaintKind.HTML),
         *(AuthorizationGuard(_sym(decorator), label) for decorator, label in _AUTHORIZATION_DECORATORS),
         # ``urlpatterns = [path('login/', views.log_in)]``: the referenced view is an
diff --git a/src/coretrace_python/engine.py b/src/coretrace_python/engine.py
index be1bfb8..d41776f 100644
--- a/src/coretrace_python/engine.py
+++ b/src/coretrace_python/engine.py
@@ -109,6 +109,7 @@
 from coretrace_python.taint import (
     EntryPoint,
     EntryPointAnalysis,
+    EscapedTemplates,
     ModelTable,
     RegisteredRoutes,
     Routes,
@@ -116,6 +117,7 @@
     SecurityModelRegistry,
     TaintAnalysis,
     TaintKind,
+    escaped_templates,
     registered_routes,
 )
 
@@ -146,6 +148,7 @@
     RefutationAnalysis,
     DependencyAnalysis,
     RegisteredRoutes,
+    EscapedTemplates,
 )
 
 
@@ -178,7 +181,14 @@ class ResultsEvicted(TransformationPass):
 
     name: ClassVar[str] = "project.results-evicted"
     preserves: ClassVar[frozenset[AnyAnalysis]] = frozenset(
-        {*SEMANTIC_ANALYSES, SecurityModelAnalysis, ProjectSummaries, DependencyAnalysis, RegisteredRoutes}
+        {
+            *SEMANTIC_ANALYSES,
+            SecurityModelAnalysis,
+            ProjectSummaries,
+            DependencyAnalysis,
+            RegisteredRoutes,
+            EscapedTemplates,
+        }
     )
 
     @classmethod
@@ -397,10 +407,12 @@ def analyze_project(
     for name in sorted(analysable):
         for symbol, registered in _routes_of(analysable[name]).items():
             routes.setdefault(symbol, registered)
+    escaped = escaped_templates(root)
     for manager in analysable.values():
         manager.provide(RegisteredRoutes, routes)
+        manager.provide(EscapedTemplates, escaped)
 
-    configuration = _configuration_key(registry, plugins, models, advisories, dependencies, routes)
+    configuration = _configuration_key(registry, plugins, models, advisories, dependencies, routes, escaped)
     keys = module_keys(
         graph,
         {name: fingerprint(configuration, str(files[name].source_id), name, files[name].text) for name in analysable},
@@ -441,6 +453,7 @@ def analyze_project(
                             encode_index(_seed(results, graph, component)),
                             advisory_paths,
                             _encode_routes(routes),
+                            tuple(sorted(escaped)),
                         ),
                     )
                     for component in pending
@@ -588,6 +601,7 @@ class _Batch:
     seed: Mapping[str, Any]
     advisory_paths: tuple[Path, ...] = ()
     routes: tuple[tuple[str, str, str, int], ...] = ()
+    escaped: tuple[str, ...] = ()
 
 
 def _analyse_batch(batch: _Batch) -> dict[str, dict[str, Any]]:
@@ -612,6 +626,7 @@ def _analyse_batch(batch: _Batch) -> dict[str, dict[str, Any]]:
         manager.provide(SecurityModelAnalysis, models)
         manager.provide(DependencyAnalysis, dependencies)
         manager.provide(RegisteredRoutes, routes)
+        manager.provide(EscapedTemplates, frozenset(batch.escaped))
     module_plugins = tuple(p for p in all_plugins if not isinstance(p, ProjectPlugin))
     results = _analyse_managers(managers, decode_index(batch.seed), module_plugins, affected)
     return {name: encode(entry) for name, entry in results.items()}
@@ -639,6 +654,7 @@ def _configuration_key(
     advisories: tuple[Advisory, ...],
     dependencies: DependencyGraph,
     routes: Routes | None = None,
+    escaped: frozenset[str] = frozenset(),
 ) -> str:
     """Everything a module's results depend on besides the project sources (§11)."""
 
@@ -658,6 +674,7 @@ def _configuration_key(
         repr(dependencies.requirements),
         repr(dependencies.errors),
         repr(_encode_routes(routes or {})),
+        repr(sorted(escaped)),
     )
 
 
diff --git a/src/coretrace_python/taint/__init__.py b/src/coretrace_python/taint/__init__.py
index b3c759d..c97f8ff 100644
--- a/src/coretrace_python/taint/__init__.py
+++ b/src/coretrace_python/taint/__init__.py
@@ -24,15 +24,18 @@
     Source,
     SuffixSink,
     TaintKind,
+    TemplateRender,
     TypedParameter,
     Validator,
 )
 from coretrace_python.taint.routes import RegisteredRoutes, Routes, registered_routes
+from coretrace_python.taint.templates import EscapedTemplates, escaped_templates
 
 __all__ = [
     "AuthorizationGuard",
     "EntryPoint",
     "EntryPointAnalysis",
+    "EscapedTemplates",
     "Model",
     "ModelError",
     "ModelTable",
@@ -52,8 +55,10 @@
     "TaintFacts",
     "TaintFlow",
     "TaintKind",
+    "TemplateRender",
     "TypedParameter",
     "Validator",
+    "escaped_templates",
     "propagate_taint",
     "registered_routes",
 ]
diff --git a/src/coretrace_python/taint/engine.py b/src/coretrace_python/taint/engine.py
index 5ae2238..63511d5 100644
--- a/src/coretrace_python/taint/engine.py
+++ b/src/coretrace_python/taint/engine.py
@@ -79,6 +79,7 @@
     TaintKind,
 )
 from coretrace_python.taint.routes import RegisteredRoutes, Routes
+from coretrace_python.taint.templates import EscapedTemplates
 
 
 @dataclass(frozen=True)
@@ -152,9 +153,12 @@ def __init__(
         heap: HeapFacts | None = None,
         seeds: Mapping[HeapLocation, Taint] | None = None,
         module: str = "",
+        escaped: frozenset[str] = frozenset(),
     ) -> None:
         self.name = name
         self.module = module
+        # As call sites record a constant argument: the way Python writes it.
+        self.escaped = frozenset(repr(name) for name in escaped)
         self.function = function
         self.models = models
         self.graph = graph
@@ -406,6 +410,8 @@ def external(
         sanitizer = self.models.sanitizer(symbol)
         if sanitizer is not None:
             return everything.without(sanitizer.kinds)
+        if self.renders_escaped(symbol, given):
+            return everything.without(TaintKind.HTML)
         # A method on a tainted object returns tainted data (``request.args.get``).
         everything = everything.join(state.get(call.callee, Taint.none()))
         source = self.models.source_covering(symbol)
@@ -413,6 +419,14 @@ def external(
             return everything.join(Taint(source.kinds, frozenset({source})))
         return everything
 
+    def renders_escaped(self, symbol: SymbolId, given: Arguments) -> bool:
+        """Whether the call renders, by a name written in the call, a template the
+        project shows escaping everything it renders."""
+
+        render = self.models.template_render(symbol)
+        named = given.given(render.keyword, render.position) if render is not None else None
+        return named is not None and named[0] and named[1] in self.escaped
+
     def guarded(self, sink: Sink | None, arguments: Arguments) -> Sink | None:
         """The sink as this call makes it: an argument declared safe (``yaml.load`` with
         ``Loader=SafeLoader``) takes off the kinds it covers, and no kind left, no sink."""
@@ -792,8 +806,9 @@ def propagate_taint(
     heap: HeapFacts | None = None,
     seeds: Mapping[HeapLocation, Taint] | None = None,
     module: str = "",
+    escaped: frozenset[str] = frozenset(),
 ) -> TaintFacts:
-    problem = _TaintProblem(name, function, models, graph, summaries, parameters, project, heap, seeds, module)
+    problem = _TaintProblem(name, function, models, graph, summaries, parameters, project, heap, seeds, module, escaped)
     solution = solve(problem, cfg)
     taints: dict[Key, Taint] = {}
     flows: list[TaintFlow] = []
@@ -821,6 +836,7 @@ class TaintAnalysis(FunctionAnalysis[TaintFacts]):
             ProjectSummaries,
             HeapAnalysis,
             RegisteredRoutes,
+            EscapedTemplates,
         }
     )
 
@@ -857,6 +873,7 @@ def sources_of(member: nodes.Function) -> Mapping[int, Source]:
             heap,
             seeds,
             ctx.module.name,
+            ctx.get(EscapedTemplates),
         )
 
 
diff --git a/src/coretrace_python/taint/models.py b/src/coretrace_python/taint/models.py
index e40f109..4bbccc5 100644
--- a/src/coretrace_python/taint/models.py
+++ b/src/coretrace_python/taint/models.py
@@ -173,6 +173,17 @@ class Validator:
     argument: int = 0
 
 
+@dataclass(frozen=True)
+class TemplateRender:
+    """A call rendering the template it names (argument ``position``, or ``keyword``)
+    with autoescaping on, such as ``render_to_string``: what it returns carries no
+    ``HTML`` when the project shows that template escaping everything it renders."""
+
+    symbol: SymbolId
+    position: int = 0
+    keyword: str = "template_name"
+
+
 @dataclass(frozen=True)
 class AuthorizationGuard:
     """A decorator, or a condition, that restricts who reaches the code behind it; a
@@ -194,6 +205,7 @@ class AuthorizationGuard:
     | RouteRegistrar
     | SuffixSink
     | SafeArgument
+    | TemplateRender
 )
 
 
@@ -210,6 +222,7 @@ class ModelTable:
     route_registrars: tuple[RouteRegistrar, ...] = ()
     suffix_sinks: tuple[SuffixSink, ...] = ()
     safe_arguments: tuple[SafeArgument, ...] = ()
+    template_renders: tuple[TemplateRender, ...] = ()
     _by_symbol: dict[type[Model], dict[SymbolId, Model]] = field(
         init=False, repr=False, compare=False
     )
@@ -225,6 +238,7 @@ def __post_init__(self) -> None:
             AuthorizationGuard: {m.symbol: m for m in self.authorizations},
             RouteRegistrar: {m.symbol: m for m in self.route_registrars},
             SafeArgument: {m.symbol: m for m in self.safe_arguments},
+            TemplateRender: {m.symbol: m for m in self.template_renders},
         }
         object.__setattr__(self, "_by_symbol", MappingProxyType(index))
 
@@ -291,6 +305,7 @@ def extended(self, *sinks: Sink) -> ModelTable:
             self.route_registrars,
             self.suffix_sinks,
             self.safe_arguments,
+            self.template_renders,
         )
 
     def sanitizer(self, symbol: SymbolId) -> Sanitizer | None:
@@ -301,6 +316,10 @@ def safe_argument(self, symbol: SymbolId) -> SafeArgument | None:
         found = self._by_symbol[SafeArgument].get(symbol)
         return found if isinstance(found, SafeArgument) else None
 
+    def template_render(self, symbol: SymbolId) -> TemplateRender | None:
+        found = self._by_symbol[TemplateRender].get(symbol)
+        return found if isinstance(found, TemplateRender) else None
+
 
 class SecurityModelRegistry:
     """Mutable collection point for the models plugins register."""
@@ -347,6 +366,7 @@ def freeze(self) -> ModelTable:
             route_registrars=tuple(m for m in models if isinstance(m, RouteRegistrar)),
             suffix_sinks=tuple(m for m in models if isinstance(m, SuffixSink)),
             safe_arguments=tuple(m for m in models if isinstance(m, SafeArgument)),
+            template_renders=tuple(m for m in models if isinstance(m, TemplateRender)),
         )
 
 
diff --git a/src/coretrace_python/taint/templates.py b/src/coretrace_python/taint/templates.py
new file mode 100644
index 0000000..951f52c
--- /dev/null
+++ b/src/coretrace_python/taint/templates.py
@@ -0,0 +1,250 @@
+"""Django templates that escape everything they render (architecture §17).
+
+``render_to_string(name, context)`` returns HTML in which autoescaping escaped every
+variable, unless the template says otherwise. The engine does not render templates; it
+reads them, and establishes that a template escapes only when nothing in it, or in what
+it extends or includes, can output data unescaped:
+
+- no ``|safe`` or ``|safeseq``, no ``{% autoescape off %}``, and no tag, filter or tag
+  library beyond Django's own, whose output a custom one could mark safe;
+- no variable where HTML escaping does not protect it: in a ``<script>`` or ``<style>``
+  block, an event handler, a ``style`` or ``srcdoc`` attribute, a URL attribute whose
+  value does not start with a fixed relative or ``http(s)`` prefix, an unquoted
+  attribute, an attribute or a tag name;
+- no Python file of the project turning autoescaping off.
+
+Templates are found under the project's ``templates`` directories, by their path below
+one. A template the engine cannot find — named by an expression, under a ``DIRS`` entry
+of another name, shipped by an installed package — is never assumed to escape.
+"""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Iterator
+from pathlib import Path
+from typing import ClassVar
+
+from coretrace_python.analysis import Analysis, AnalysisContext
+from coretrace_python.interprocedural import discover_files
+
+TEMPLATES_DIRECTORY = "templates"
+
+_OUTPUT, _TAG, _URL = "\x00", "\x01", "/u"
+_SYNTAX = re.compile(r"{{(.*?)}}|{%(.*?)%}|{#.*?#}", re.DOTALL)
+_AUTOESCAPE_OFF = re.compile(r"""["']autoescape["']\s*:\s*False|\bautoescape\s*=\s*False""")
+
+# Django's own libraries, tags and filters. Every filter but ``safe`` and ``safeseq``
+# escapes its input, or returns it for autoescaping to escape, when autoescaping is on.
+_LIBRARIES = frozenset({"static", "i18n", "l10n", "tz", "cache", "humanize"})
+_TAGS = frozenset(
+    {
+        "load", "extends", "include", "block", "endblock", "if", "elif", "else", "endif",
+        "for", "empty", "endfor", "with", "endwith", "ifchanged", "endifchanged", "spaceless",
+        "endspaceless", "filter", "endfilter", "autoescape", "endautoescape", "csrf_token",
+        "now", "lorem", "widthratio", "templatetag", "regroup", "resetcycle", "url", "static",
+        "get_static_prefix", "get_media_prefix", "firstof", "cycle", "trans", "translate",
+        "blocktrans", "blocktranslate", "endblocktrans", "endblocktranslate", "plural",
+        "get_current_language", "get_current_language_bidi", "get_available_languages",
+        "get_language_info", "get_language_info_list", "language", "endlanguage", "localize",
+        "endlocalize", "localtime", "endlocaltime", "timezone", "endtimezone",
+        "get_current_timezone", "cache", "endcache",
+    }
+)
+# Tags that print a value: checked where they stand, like a variable.
+_PRINTING = frozenset({"firstof", "cycle", "trans", "translate"})
+_FILTERS = frozenset(
+    {
+        "add", "addslashes", "capfirst", "center", "cut", "date", "default", "default_if_none",
+        "dictsort", "dictsortreversed", "divisibleby", "escape", "escapejs", "escapeseq",
+        "filesizeformat", "first", "floatformat", "force_escape", "get_digit", "iriencode",
+        "join", "json_script", "last", "length", "length_is", "linebreaks", "linebreaksbr",
+        "linenumbers", "ljust", "lower", "make_list", "phone2numeric", "pluralize", "pprint",
+        "random", "rjust", "slice", "slugify", "stringformat", "striptags", "time", "timesince",
+        "timeuntil", "title", "truncatechars", "truncatechars_html", "truncatewords",
+        "truncatewords_html", "unordered_list", "upper", "urlencode", "urlize", "urlizetrunc",
+        "wordcount", "wordwrap", "yesno", "language_name", "language_name_local",
+        "language_bidi", "language_name_translated", "localize", "unlocalize", "localtime",
+        "utc", "timezone", "apnumber", "intcomma", "intword", "naturalday", "naturaltime",
+        "ordinal",
+    }
+)
+
+_URL_ATTRIBUTES = frozenset(
+    {
+        "href", "src", "action", "formaction", "poster", "background", "cite", "data",
+        "srcset", "ping", "manifest", "longdesc", "usemap", "codebase", "classid", "archive",
+        "profile", "lowsrc", "dynsrc", "icon", "xlink:href",
+    }
+)
+# A relative path (not ``//host``), a fragment, a query, or an http(s) URL whose host is
+# fixed: no scheme such as ``javascript:`` can follow.
+_SAFE_URL_PREFIX = re.compile(r"(?:/(?!/)|\.{1,2}/|[#?]|https?://[^/?#\x00\x01]+[/?#])")
+_QUOTED = r"\"[^\"]*\"|'[^']*'"
+_ATTRIBUTE = re.compile(rf"([^\s\"'>/=]+)(?:\s*=\s*({_QUOTED}|[^\s\"'=<>`]+))?")
+_START_TAG = re.compile(rf"<([A-Za-z][^\s/>]*)((?:\s*[^\s\"'>/=]+(?:\s*=\s*(?:{_QUOTED}|[^\s\"'=<>`]+))?)*)\s*/?>")
+_RAW_TEXT = re.compile(r"<(script|style)\b[^>]*>(.*?)</\1\s*>", re.DOTALL | re.IGNORECASE)
+_COMMENT = re.compile(r"<!--.*?-->", re.DOTALL)
+_END_TAG = re.compile(r"</[A-Za-z][^>]*>")
+
+
+def escaped_templates(root: Path) -> frozenset[str]:
+    """The names of the templates under ``root`` that escape every variable they render,
+    as ``render_to_string`` names them (their path below a ``templates`` directory)."""
+
+    found: dict[str, list[Path]] = {}
+    for path in discover_files(root):
+        if path.suffix == ".py" and _AUTOESCAPE_OFF.search(_read(path)):
+            return frozenset()
+        for name in _names(path.relative_to(root).parts):
+            found.setdefault(name, []).append(path)
+    local: dict[str, bool] = {}
+    requires: dict[str, set[str]] = {}
+    for name, paths in found.items():
+        verdicts = [_inspect(_read(path)) for path in paths]
+        local[name] = all(safe for safe, _ in verdicts)
+        requires[name] = {needed for _, needs in verdicts for needed in needs}
+    escaped = {name for name, safe in local.items() if safe}
+    changed = True
+    while changed:
+        kept = {name for name in escaped if requires[name] <= escaped}
+        changed = kept != escaped
+        escaped = kept
+    return frozenset(escaped)
+
+
+def _names(parts: tuple[str, ...]) -> Iterator[str]:
+    for index, part in enumerate(parts[:-1]):
+        if part == TEMPLATES_DIRECTORY:
+            yield "/".join(parts[index + 1 :])
+
+
+def _read(path: Path) -> str:
+    try:
+        return path.read_text(encoding="utf-8", errors="replace")
+    except OSError:
+        return ""
+
+
+def _inspect(text: str) -> tuple[bool, set[str]]:
+    """Whether the template escapes all it prints itself, and the templates it extends
+    or includes, which must escape too."""
+
+    requires: set[str] = set()
+    html: list[str] = []
+    skipping: str | None = None
+    position = 0
+    text = text.replace(_OUTPUT, "").replace(_TAG, "")
+    for match in _SYNTAX.finditer(text):
+        variable, tag = match.group(1), match.group(2)
+        words = tag.split() if tag is not None else []
+        if skipping is not None:
+            if words[:1] == [skipping]:
+                if skipping == "endverbatim":
+                    html.append(text[position : match.start()])
+                skipping, position = None, match.end()
+            continue
+        html.append(text[position : match.start()])
+        position = match.end()
+        if variable is not None:
+            if not _escaping_filters(variable):
+                return False, requires
+            html.append(_OUTPUT)
+        elif words and words[0] in ("comment", "verbatim"):
+            skipping = f"end{words[0]}"
+            if words[0] == "verbatim":
+                position = match.end()
+        elif words:
+            name = words[0]
+            if name not in _TAGS:
+                return False, requires
+            if name == "load" and not set(_loaded(words[1:])) <= _LIBRARIES:
+                return False, requires
+            if name == "autoescape" and words[1:] != ["on"]:
+                return False, requires
+            if name == "filter" and not _escaping_filters(tag.split(None, 1)[1] if len(words) > 1 else ""):
+                return False, requires
+            if name in ("extends", "include"):
+                needed = _constant(words[1] if len(words) > 1 else "")
+                if needed is None:
+                    return False, requires
+                requires.add(needed)
+            html.append(_OUTPUT if name in _PRINTING else _URL if name in ("url", "static") else _TAG)
+    if skipping is not None:
+        return False, requires
+    html.append(text[position:])
+    return _escapes_where_printed("".join(html)), requires
+
+
+def _loaded(words: list[str]) -> list[str]:
+    """The libraries ``{% load a b %}`` or ``{% load x y from lib %}`` loads."""
+
+    return words[words.index("from") + 1 :] if "from" in words else words
+
+
+def _escaping_filters(expression: str) -> bool:
+    filters = re.sub(_QUOTED, "", expression).split("|")[1:]
+    return all(f.split(":", 1)[0].strip() in _FILTERS for f in filters)
+
+
+def _constant(word: str) -> str | None:
+    return word[1:-1] if len(word) >= 2 and word[0] == word[-1] and word[0] in "\"'" else None
+
+
+def _escapes_where_printed(html: str) -> bool:
+    """Whether every output marker of ``html`` stands where HTML escaping protects it."""
+
+    position = 0
+    while (start := html.find("<", position)) != -1:
+        rest = html[start:]
+        comment = _COMMENT.match(rest)
+        raw = _RAW_TEXT.match(rest)
+        tag = _START_TAG.match(rest)
+        end = _END_TAG.match(rest)
+        if comment:
+            position = start + comment.end()
+        elif raw:
+            if _OUTPUT in raw.group(2) or not _attributes_escape(raw.group(0)[: raw.start(2)]):
+                return False
+            position = start + raw.end()
+        elif tag:
+            if _OUTPUT in tag.group(1) or not _attributes_escape(tag.group(2)):
+                return False
+            position = start + tag.end()
+        elif end:
+            if _OUTPUT in end.group(0):
+                return False
+            position = start + end.end()
+        else:
+            # ``<{{ name }}``: the variable would name a tag, escaping cannot stop it.
+            if rest[1:].lstrip("/ \t\n").startswith(_OUTPUT):
+                return False
+            position = start + 1
+    return True
+
+
+def _attributes_escape(attributes: str) -> bool:
+    for match in _ATTRIBUTE.finditer(attributes):
+        name, value = match.group(1).lower(), match.group(2)
+        if _OUTPUT in name:
+            return False
+        if value is None or _OUTPUT not in value:
+            continue
+        if value[0] not in "\"'" or name.startswith("on") or name in ("style", "srcdoc"):
+            return False
+        if name in _URL_ATTRIBUTES:
+            prefix = value[1:].split(_OUTPUT, 1)[0]
+            if _TAG in prefix or not _SAFE_URL_PREFIX.match(prefix):
+                return False
+    return True
+
+
+class EscapedTemplates(Analysis[frozenset[str]]):
+    """The names of the project templates that escape everything they render, provided
+    by the engine for a project; none on its own."""
+
+    name: ClassVar[str] = "taint.escaped_templates"
+
+    @classmethod
+    def compute(cls, ctx: AnalysisContext) -> frozenset[str]:
+        return frozenset()
diff --git a/tests/regression/expected/pygoat.json b/tests/regression/expected/pygoat.json
index 60491d4..e4238fb 100644
--- a/tests/regression/expected/pygoat.json
+++ b/tests/regression/expected/pygoat.json
@@ -168,24 +168,6 @@
       "rule": "unsafe-xml",
       "function": "xxe_parse"
     },
-    {
-      "file": "introduction/views.py",
-      "line": 290,
-      "rule": "xss",
-      "function": "auth_lab_signup"
-    },
-    {
-      "file": "introduction/views.py",
-      "line": 304,
-      "rule": "xss",
-      "function": "auth_lab_login"
-    },
-    {
-      "file": "introduction/views.py",
-      "line": 318,
-      "rule": "xss",
-      "function": "auth_lab_login"
-    },
     {
       "file": "introduction/views.py",
       "line": 430,