Cross-site scripting
User-controllable input must be sanitized before it's included in output used to dynamically generate a web page. Unsanitized user input can introduce cross-side scripting (XSS) vulnerabilities that can lead to inadvertedly running malicious code in a trusted context.
from flask import app


@app.route('/redirect')
def redirect_url_noncompliant():
    from flask import request, redirect
    endpoint = request.args['url']
    # Noncompliant: redirect to a user-supplied URL without sanitization.
    return redirect(endpoint)
from flask import app


@app.route('/redirect')
def redirect_url_compliant():
    from flask import request, url_for, redirect
    endpoint = request.args['url']
    # Compliant: user-supplied URL is sanitized before redirecting to it.
    return redirect(url_for(endpoint))