XSS Prevention for Flask

render_template_string() renders a Jinja2 template directly from a string. If the template is modified in any way, such as with string formatting, it creates a potential server-side template injection. Using render_template() is strictly safer because it does not create an opportunity to modify the template.

Recommendation: Use render_template().

Code example:

render_template_string("<div>%s</div>" % request.args.get("name"))

References:

• Exploring SSTI in Flask/Jinja2
• Flask & Jinja2 SSTI Cheatsheet

Flask only escapes templates with .html, .htm, .xml, or .xhtml extensions. This is not always obvious and could create cross-site scripting vulnerabilities.

Recommendation: Only use .html extensions for templates. If no escaping is needed, review each case and exempt with # nosem.

Code example:

render_template("unsafe.jinja2")

References:

• Flask documentation - Escaping behavior
• Bento check - Unescaped Template Extension
• Unescaped template extensions in Flask

Markup() disables HTML escaping for the returned content. This permits raw HTML to be rendered in a template, which could create a XSS vulnerability.

Recommendation: If needed, review each usage and exempt with # nosem.

Code example:

flask.Markup(html_content)

References:

• Flask autoescaping documentation

Returning values directly from a route bypasses the template rendering engine, therefore bypassing any escaping. Use functionality provided by Flask to return content from routes, such as render_template() or jsonify().

Recommendation: Use render_template() or jsonify().

Code example:

@app.route("/index/<msg>")
def index(msg):
  return "Hello! " + msg

References:

• Reflected server-side cross-site scripting

Flask already comes with a Jinja2 environment ready for use which can be invoked via the render_template() function. Using Jinja2 directly may bypass the escaping protections that are enabled in Flask by default.

Recommendation: Use render_template().

Code example:

with open('template', 'r') as fin:
  jinja2.Template(fin.read()).render()

References:

• Bandit Check - Jinja2 Autoescape False

The | safe filter disables HTML escaping for the provided content. This permits raw HTML to be rendered in a template, which could create a XSS vulnerability.

Recommendation: Use Markup() in Python code if necessary.

Code example:

{{ name | safe }}

References:

• Flask autoescaping documentation

The {$ autoescape false %} block disables autoescaping for whole portions of the template. Disabling autoescaping allows HTML characters to be rendered directly onto the page which could create XSS vulnerabilities.

Recommendation: Use Markup() in Python code if necessary.

Code example:

{% autoescape false %}

References:

• Flask autoescaping documentation

Unquoted template variables rendered into HTML attributes is a potential XSS vector because an attacker could inject JavaScript handlers which do not require HTML characters. An example handler might look like: onmouseover=alert(1). HTML escaping will not mitigate this. The variable must be quoted to avoid this.

Recommendation: Always use quotes around HTML attributes.

Code example:

<div class={{ classes }}></div>

References:

• Flask cross-site scripting considerations

Template variables in a href value could still accept the javascript: URI. This could be a XSS vulnerability. HTML escaping will not prevent this. Use url_for to generate links.

Recommendation: Use url_for to generate links.

Code example:

<a href="{{ link }}"></a>

References:

• Flask cross-site scripting considerations

Template variables placed directly into JavaScript or similar are now directly in a code execution context. Normal HTML escaping will not prevent the possibility of code injection because code can be written without HTML characters. This creates the potential for XSS vulnerabilities, or worse.

Recommendation: Use the tojson filter inside a data attribute and JSON.parse() in JavaScript.

Code example:

<script>var name = {{ name }};</script>

References:

• Template engines: Why default encoders are not enough
• tojson documentation
• How to use tojson in a data attribute
• Safely including data for JavaScript in a Django template