Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed jinja2 environment autoescape to enable select extensions #1277

Merged
merged 1 commit into from
Apr 6, 2021

Conversation

mstfbl
Copy link
Contributor

@mstfbl mstfbl commented Apr 5, 2021

This PR fixes an issue pointed out by Bandit w.r.t. using autoescape=False with a Jinja2 environment to avoid cross-site scripting vulnerabilities.

Bandit output:

>> Issue: [B701:jinja2_autoescape_false] Using jinja2 templates with autoescape=False is dangerous and can lead to XSS. Use autoescape=True or use the select_autoescape function to mitigate XSS vulnerabilities.
   Severity: High   Confidence: High
   Location: ./.circleci/regenerate.py:184
   More Info: https://bandit.readthedocs.io/en/latest/plugins/b701_jinja2_autoescape_false.html
183	    d = os.path.dirname(__file__)
184	    env = jinja2.Environment(
185	        loader=jinja2.FileSystemLoader(d),
186	        lstrip_blocks=True,
187	        autoescape=False,
188	    )

@codecov
Copy link

codecov bot commented Apr 5, 2021

Codecov Report

Merging #1277 (450d14b) into master (93b03e4) will not change coverage.
The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##           master    #1277   +/-   ##
=======================================
  Coverage   78.80%   78.80%           
=======================================
  Files          67       67           
  Lines        3624     3624           
=======================================
  Hits         2856     2856           
  Misses        768      768           

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 93b03e4...450d14b. Read the comment docs.

@malfet malfet merged commit 803651c into pytorch:master Apr 6, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants