2 ms·
This code looks like it has an XSS vulnerability in the submit() method: returning plain f-string i.e. return f"<tr> <td>{title}</td> <td>{
by danjac 5y ago
This code looks like it has an XSS vulnerability in the submit() method: returning plain f-string i.e.
return f"<tr>
<td>{title}</td>
<td>{author_name}</td>
<td>...."
Probably safer (and more maintainable) to just return a Jinja2 template instead.
- qatanah 5y agoSomething I've wanted to comment on this as well. It's best to use render_template() when rendering the views so it doesn't tangle w/ a lot of python controller logic.