-
-
Notifications
You must be signed in to change notification settings - Fork 681
Description
Is your feature request related to a problem? Please describe.
markupsafe.Markup
is semantically similar to Django's mark_safe
(or SafeString
) (B308), it marks the wrapped string as passing unmodified through markupsafe.escape
.
Notably, markupsafe
is what Jinja relies on for its (auto)-escaping, it is explicitly documented in that context.
Markup
-ing literal content is normally safe, but non-literal content either is suspicious, or should be formatted in via Markup.format
or Markup.__mod__
(which automatically escapes non-Markup
content).
Describe the solution you'd like
Bandit flagging such uses, maybe as part of B308, maybe as a new and separate diagnosis.
Also maybe django.utils.safestring.SafeString
and django.utils.safestring.SafeText
should be added to B308? mark_safe
is just a pretty thin wrapper around SafeString
which handles the __html__
protocol and can be used as a decorator.