Skip to content
This repository was archived by the owner on Sep 10, 2025. It is now read-only.

Conversation

@mstfbl
Copy link
Contributor

@mstfbl mstfbl commented Apr 5, 2021

This PR fixes an issue pointed out by Bandit w.r.t. using autoescape=False with a Jinja2 environment to avoid cross-site scripting vulnerabilities.

Bandit output:

>> Issue: [B701:jinja2_autoescape_false] Using jinja2 templates with autoescape=False is dangerous and can lead to XSS. Use autoescape=True or use the select_autoescape function to mitigate XSS vulnerabilities.
   Severity: High   Confidence: High
   Location: ./.circleci/regenerate.py:184
   More Info: https://bandit.readthedocs.io/en/latest/plugins/b701_jinja2_autoescape_false.html
183	    d = os.path.dirname(__file__)
184	    env = jinja2.Environment(
185	        loader=jinja2.FileSystemLoader(d),
186	        lstrip_blocks=True,
187	        autoescape=False,
188	    )

@codecov
Copy link

codecov bot commented Apr 5, 2021

Codecov Report

Merging #1277 (450d14b) into master (93b03e4) will not change coverage.
The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##           master    #1277   +/-   ##
=======================================
  Coverage   78.80%   78.80%           
=======================================
  Files          67       67           
  Lines        3624     3624           
=======================================
  Hits         2856     2856           
  Misses        768      768           

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 93b03e4...450d14b. Read the comment docs.

@malfet malfet merged commit 803651c into pytorch:master Apr 6, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants