Repository navigation
fix: never assume an unreadable template file escapes - #179
Merged
Merged
Conversation
A template file the engine cannot read proves nothing about escaping: the flow through render_to_string stays xss, and a template extending or including it is not established to escape either.
escaped_templates read a template file it could not open as empty text, and an empty template escapes everything it renders. Such a file now yields no escaping verdict, like a template the engine cannot find, so the flow stays xss and the templates needing it are not established either.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
escaped_templatesread a template file it could not open (permissions) as empty text, and an empty template escapes everything it renders, so the flow throughrender_to_stringwas dropped as safe. Such a file now yields no escaping verdict, like a template the analyzer cannot find: the flow staysxss, and a template extending or including the unreadable one is not established to escape either. The unreadable file was already listed among the templates the run could not read (0.16.0), so the VEX side was right; the XSS judgement was not.Out of scope, on purpose: an unreadable Python file still counts as setting no
autoescape = False. It is reported asunreadablein the coverage, and the escaping rule's other conditions are about templates; say so if you want it to disable the judgement too.Verification
xss.tests/test_unreadable_templates.py: 4 passed (skipped as root or off POSIX, where a file cannot be made unreadable). Targeted template tests and docs tests pass; full suite under Python 3.12.10: 1438 passed.ruff checkandmypypass.