mcp-server-semgrep/semgrep-rules/python/jinja2/security/audit/autoescape-disabled-false.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: incorrect-autoescape-disabled
  patterns:
  - pattern: jinja2.Environment(... , autoescape=$VAL, ...)
  - pattern-not: jinja2.Environment(... , autoescape=True, ...)
  - pattern-not: jinja2.Environment(... , autoescape=jinja2.select_autoescape(...), ...)
  - focus-metavariable: $VAL
  fix: |
    True
  message: >-
    Detected a Jinja2 environment with 'autoescaping' disabled.
    This is dangerous if you are rendering to a browser because this allows for cross-site
    scripting (XSS) attacks. If you are in a web context, enable 'autoescaping' by setting
    'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable
    automatic escaping for certain file extensions.
  metadata:
    source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b701_jinja2_autoescape_false.html
    cwe:
    - 'CWE-116: Improper Encoding or Escaping of Output'
    owasp:
    - A03:2021 - Injection
    references:
    - https://jinja.palletsprojects.com/en/2.11.x/api/#basics
    category: security
    technology:
    - jinja2
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
  languages: [python]
  severity: WARNING