CODEWITHSUNDEEP
pythonsecurityescapingjinja2
flybywire
flybywire

Reputation: 273502

How do I html-escape dangerous unsanitized input in jinja2?

Can I do it inside the template or must it be done in python code?

I have a variable that may contain da<ngero>u&s chars. How do I escape it in jinja2?

Upvotes: 40

Views: 43219

Answers (5)

jitter
jitter

Reputation: 54605

e.g.

{{ user.username|e }}

Pipe it through the |e filter

Docs:

Upvotes: 66

Huey Eng
Huey Eng

Reputation: 1

You can do a string check and replace with the corresponding escaped characters.

For example: string=I am a special character <
Do the following:

string.replace("<","&lt ;")

Note that in your code, the space between t and ; has been eliminated. Can't eliminate this here as it will be formatted to show < instead :P

Then use jinja2 to print out the formatted string. The < should appear in your display.

Upvotes: -3

philfreo
philfreo

Reputation: 43804

Flask has a built in tojson filter:

http://flask.pocoo.org/docs/templating/#standard-filters

Upvotes: 1

jianpx
jianpx

Reputation: 3330

If you want to escape html in your programme, you can do it like this(example):

>>> import jinja2
>>> jinja2.__version__
'2.6'
>>> a
'<script>alert("yy")</script>'
>>> jinja2.escape(a)
Markup(u'&lt;script&gt;alert(&#34;yy&#34;)&lt;/script&gt;')
>>> str(jinja2.escape(a))
'&lt;script&gt;alert(&#34;yy&#34;)&lt;/script&gt;'

Upvotes: 11

Jeroen Dierckx
Jeroen Dierckx

Reputation: 1638

You could also tell the environment to autoescape everything:

e = Environment(loader=fileloader, autoescape=True)

note: in jinja1 this is auto_escape

Upvotes: 25

Related Questions