flawopen.com/क्रॉस-साइट स्क्रिप्टिंग/Python

क्रॉस-साइट स्क्रिप्टिंग in Python

उच्च CWE-79 Draft — pending review
Language: English Português (Brasil) Español Français Deutsch Русский 简体中文 日本語 हिन्दी 한국어 Bahasa Indonesia
सरल व्याख्या (ELI5)

Imagine a guestbook where a visitor writes a note containing hidden script tags that execute in the browser of the next person who opens the page.

इस पृष्ठ पर मुख्य शर्तें
output encoding
Converting special markup characters into safe entities so browsers display them as text rather than script.

क्या हो रहा है

क्रॉस-साइट स्क्रिप्टिंग in Python occurs when untrusted input is formatted directly into HTML strings instead of using template auto-escaping.

वास्तविक दुनिया का प्रभाव

In 2005, the Samy XSS worm infected over 1 million user profiles on MySpace in under 20 hours, forcing the platform offline.

Documented historical AppSec case study.

असुरक्षित बनाम सुरक्षित कोड

VULNERABLE
# username inserted with no escaping
@app.route("/welcome")
def welcome():
  name = request.args.get("name")
  return f"
Welcome, {name}
"
FIXED
# Jinja2 template auto-escapes by default
@app.route("/welcome")
def welcome():
  name = request.args.get("name")
  return render_template("welcome.html", name=name)

समाधान कैसे काम करता है

Template engines like Jinja2 and Django auto-escape HTML entities by default, rendering markup inert.

भाषा-विशिष्ट सावधानियां

Django mark_safe() and Jinja2 | safe

Marking untrusted data as safe disables all escaping, reopening stored and reflected XSS.

f-strings bypass templates

Python f-strings execute before template rendering, bypassing auto-escaping entirely.

आम गलतफहमियां

"f-strings are safe inside templates"

f-strings evaluate before template escaping happens, leaving user input completely raw.

प्रभावित होने की जांच कैसे करें

grep -rn "render_template_string(.*f\"" --include="*.py" . grep -rn "mark_safe(" --include="*.py" .
Run Bandit with rule B701 (jinja2_autoescape_false) in CI to catch unescaped templates automatically.

रोकथाम चेकलिस्ट

अक्सर पूछे जाने वाले प्रश्न

Does Flask escape by default?

Yes, for .html, .htm, and .xml template extensions rendered with render_template().

संदर्भ

इस भाषा में देखें: Python Python JavaScript Java Go PHP C# Rust
यह भी देखें: SQL Injection Command InjectionPath Traversal