jinja2 3.1.6: Stop jinja2 rendering user input as raw HTML — autoescape is OFF by default

{"case":{"caseId":"case:sha256:255a37fb451a5c4b6b2f574898789abf9bc8b0aa17e0bd775dc57b86056063d5","constraints":{"runtime":"python"},"contract":["render a template with a bare Environment and show HTML is NOT escaped","assert autoescape=True escapes the same input","assert select_autoescape enables it for html but not txt","assert Markup marks trusted HTML as safe even when escaping is on"],"goal":"Stop jinja2 rendering user input as raw HTML — autoescape is OFF by default","kind":"FIX","packages":["pkg:pypi/jinja2@3.1.6"],"schemaVersion":1,"symbols":["Environment","autoescape","Markup"]},"contractCommand":["python","test/contract.py"],"environment":{"arch":"x64","ecosystem":"pypi","executionContext":"python","language":"python","os":"linux","packageManager":"pip","runtime":"python","runtimeVersion":"3.12","schemaVersion":1},"license":"MIT-0","packages":["pkg:pypi/jinja2@3.1.6"],"schemaVersion":1,"symbols":["Environment","autoescape","Markup"],"verifierAdapter":"python@1"}

jinja2==3.1.6
markupsafe==3.0.3

"""jinja2 escaping, which is off unless you turn it on."""

from jinja2 import Environment, select_autoescape
from markupsafe import Markup


def render(template, autoescape=False, **values):
    """Render a template string.

    jinja2's default Environment has autoescape=False. Flask turns it on for
    .html templates, which is why the same code is safe in a Flask app and
    an injection hole in a script that builds its own Environment. There is
    no warning either way — the output simply contains whatever was passed.
    """
    env = Environment(autoescape=autoescape)
    return env.from_string(template).render(**values)


def render_for(filename, template, **values):
    """Escape based on the file type, the way Flask does."""
    env = Environment(autoescape=select_autoescape(default_for_string=False))
    env.policies["ext.i18n.trimmed"] = False
    return env.from_string(template).render(**values)


def trusted(html):
    """Mark HTML as already-safe so escaping leaves it alone."""
    return Markup(html)

import os
import sys

sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
from jinja2 import Environment, select_autoescape

from src.render import render, trusted

hostile = "<script>alert(1)</script>"

# The default: NOT escaped. This is the whole point of the sample.
plain = render("<p>{{ text }}</p>", text=hostile)
assert "<script>" in plain, plain

# Turned on, the same input is escaped.
safe = render("<p>{{ text }}</p>", autoescape=True, text=hostile)
assert "<script>" not in safe, safe
assert "&lt;script&gt;" in safe, safe

# select_autoescape keys off the template name, which is how Flask does it.
env = Environment(autoescape=select_autoescape(enabled_extensions=("html",)))
assert env.autoescape("page.html") is True
assert env.autoescape("message.txt") is False

# Markup is the escape hatch for HTML you actually trust.
kept = render("<p>{{ text }}</p>", autoescape=True, text=trusted("<b>bold</b>"))
assert "<b>bold</b>" in kept, kept

print("CONTRACT PASS: jinja2 escaped only when told to, and honoured Markup")