flawopen.com/Cross-Site Scripting/Python
Imagine a guestbook where a visitor writes a note containing hidden script tags that execute in the browser of the next person who opens the page.
Cross-Site Scripting in Python occurs when untrusted input is formatted directly into HTML strings instead of using template auto-escaping.
In 2005, the Samy XSS worm infected over 1 million user profiles on MySpace in under 20 hours, forcing the platform offline.
Documented historical AppSec case study.# username inserted with no escaping
@app.route("/welcome")
def welcome():
name = request.args.get("name")
return f"Welcome, {name}"
# Jinja2 template auto-escapes by default
@app.route("/welcome")
def welcome():
name = request.args.get("name")
return render_template("welcome.html", name=name)
Template engines like Jinja2 and Django auto-escape HTML entities by default, rendering markup inert.
Marking untrusted data as safe disables all escaping, reopening stored and reflected XSS.
Python f-strings execute before template rendering, bypassing auto-escaping entirely.
f-strings evaluate before template escaping happens, leaving user input completely raw.
grep -rn "render_template_string(.*f\"" --include="*.py" .
grep -rn "mark_safe(" --include="*.py" .
Yes, for .html, .htm, and .xml template extensions rendered with render_template().