Re-added Jinja escaping
import os.path
import jinja2
+from jinja2 import select_autoescape
+
templates = "templates"
@@ -31,7 +33,8 @@ def get_jinja_env():
Returns a Jinja environment with a FileSystemLoader for our templates
"""
templates_directory = os.path.abspath(os.path.join(__file__, '..', '..', templates))
- jinja_environment = jinja2.Environment(loader=jinja2.FileSystemLoader(templates_directory)) # nosec
- # templates are HTML escaped elsewhere
+ jinja_environment = jinja2.Environment(loader=jinja2.FileSystemLoader(templates_directory), # nosec
+ autoescape=select_autoescape(['html', 'xml']))
+ # nosec - jinja autoescape enabled for potentially dangerous extensions html, xml
#jinja_environment.filters['dateformat'] = dateformat
return jinja_environment
