Enable Jinja2 autoescaping (#200)
- Enable Jinja2 autoescape by default in the template environment. - Use json.dumps to safely inject sso_name into JavaScript context. - Fix linting issue (line too long) in injected_auth_page.py. - Update tests to verify escaping and safe injection. --------- Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com> Co-authored-by: werdnum <271070+werdnum@users.noreply.github.com>
This commit is contained in:
@@ -149,3 +149,4 @@ async def test_frontend_injection(hass: HomeAssistant, hass_client):
|
||||
text = await resp.text()
|
||||
|
||||
assert "<script src='/auth/oidc/static/injection.js" in text
|
||||
assert "window.sso_name = \"OpenID Connect (SSO)\";" in text
|
||||
|
||||
Reference in New Issue
Block a user