Skip to content

Flag markupsafe.Markup on non-literal content #1067

@xmo-odoo

Description

@xmo-odoo

Is your feature request related to a problem? Please describe.
markupsafe.Markup is semantically similar to Django's mark_safe (or SafeString) (B308), it marks the wrapped string as passing unmodified through markupsafe.escape.

Notably, markupsafe is what Jinja relies on for its (auto)-escaping, it is explicitly documented in that context.

Markup-ing literal content is normally safe, but non-literal content either is suspicious, or should be formatted in via Markup.format or Markup.__mod__ (which automatically escapes non-Markup content).

Describe the solution you'd like
Bandit flagging such uses, maybe as part of B308, maybe as a new and separate diagnosis.

Also maybe django.utils.safestring.SafeString and django.utils.safestring.SafeText should be added to B308? mark_safe is just a pretty thin wrapper around SafeString which handles the __html__ protocol and can be used as a decorator.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions