4 ms·

Data isn't user-supplied data, so just don't put Javascript code there yourself and you'll be fine.

• ptx 4y ago
  The second example from the documentation [1] disagrees. It displays HTTP header values, which are user supplied, without properly encoding them. Also, it's not just about JavaScript. If values aren't properly encoded as HTML, the app is just plain broken when it tries to display text that contains certain character sequences. For example, the app is not capable of displaying the data value "To create a heading in HTML, use <h1>My heading</h1>". The values need to be separated from the format string and passed through an encoding function such as html.escape [2]. Django learned this lesson 15 years ago in version 1.0 [3]. [1] https://github.com/healeycodes/jar#fresh-pages https://github.com/healeycodes/jar#fresh-pages [2] https://docs.python.org/3/library/html.html#html.escape https://docs.python.org/3/library/html.html#html.escape [3] https://docs.djangoproject.com/en/3.2/releases/1.0-porting-guide/#learn-to-love-autoescaping https://docs.djangoproject.com/en/3.2/releases/1.0-porting-g...
  • Jiocus 4y ago
    Sure, you're right about that and I agree with the specifics, but your message doesn't feel relevant to the OP or the discussion. Is it a reasonable expectation that every dev and blog posts must rehash all of OWASP and audit their experimental frameworks (now several years in the making) before publishing?
    • ptx 4y ago
      Templating is a core concern of a web framework, so a fundamental design flaw in the templating mechanism seems relevant.