Add flask.Markup XSS plugin

[raj3shp]

Hi,
I would like to contribute another plugin based on Flask's security consideration about calling flask.Markup on user submitted data.

Cheers!

[sigmavirus24]

I feel as if this should be not in core but a separate plugin that users can install

[raj3shp]

Hi @sigmavirus24 ,
Thanks for your comment. I consider this to be flask equivalent of django_mark_safe pluging in bandit core. Could you please elaborate the reason behind your thinking? Also regarding, "not in core separate plugin that users can install" -where are such plugins be hosted?

[Daverball]

Considering flask.Markup is just an alias for markupsafe.Markup, which is much more broadly used than flask itself (it's also used in jinja, which already has its own bandit rules), it makes a lot more sense to implement this relative to markupsafe rather than flask, although it should be fine to support the alias as well.

But I would concur that it makes sense to add this plugin to bandit. I don't see why this should be separate, considering the existing plugins in core.

That being said the implementation could be greatly improved. This rule is much too broad. It's always fine to pass a literal/uninterpolated string into Markup. I also don't think it's necessary to mark unescape as dangerous, since it should be fine as long as you don't pass the unescaped string into another function which should only accept safe markup.

[Daverball]

@ericwb @lukehinds @sigmavirus24 As long as there's some interest, considering the precedent set by django/jinja/mako, I'd be happy to take a stab at an implementation for markupsafe.Markup with fewer false positives. I.e. allowing literal/uninterpolated strings to be passed into Markup and ignoring use of unescape, since with consistent type annotations unsafe use of unescaped markup should be caught by type checkers, since only Markup is safe to render unescaped, str is not.