public/hass-oidc-auth
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enable Jinja2 autoescaping (#200)

Browse Source 
- Enable Jinja2 autoescape by default in the template environment.
- Use json.dumps to safely inject sso_name into JavaScript context.
- Fix linting issue (line too long) in injected_auth_page.py.
- Update tests to verify escaping and safe injection.

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: werdnum <271070+werdnum@users.noreply.github.com>
This commit is contained in:
Andrew Garrett
2026-02-06 19:07:54 +11:00
committed by Christiaan Goossens
parent 9bf2372b7e
commit a0e833ba69
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
custom_components/auth_oidc/views/loader.py
View File

@@ -54,7 +54,9 @@ class AsyncTemplateRenderer:
if template_name not in templates: if template_name not in templates:
raise ValueError(f"Template '{template_name}' not found.") raise ValueError(f"Template '{template_name}' not found.")
env = Environment(loader=DictLoader(templates), enable_async=True) env = Environment(
loader=DictLoader(templates), enable_async=True, autoescape=True
)
template = env.get_template(template_name) template = env.get_template(template_name)
# Render template # Render template