flawopen.com/クロスサイトスクリプティング/Python
Imagine a guestbook where a visitor writes a note containing hidden script tags that execute in the browser of the next person who opens the page.
クロスサイトスクリプティング in Python occurs when untrusted input is formatted directly into HTML strings instead of using template auto-escaping.
In 2005, the Samy XSS worm infected over 1 million user profiles on MySpace in under 20 hours, forcing the platform offline.
Documented historical AppSec case study.# username inserted with no escaping
@app.route("/welcome")
def welcome():
name = request.args.get("name")
return f"Welcome, {name}"
# Jinja2 template auto-escapes by default
@app.route("/welcome")
def welcome():
name = request.args.get("name")
return render_template("welcome.html", name=name)
Template engines like Jinja2 and Django auto-escape HTML entities by default, rendering markup inert.
Marking untrusted data as safe disables all escaping, reopening stored and reflected XSS.
Python f-strings execute before template rendering, bypassing auto-escaping entirely.
f-strings evaluate before template escaping happens, leaving user input completely raw.
grep -rn "render_template_string(.*f\"" --include="*.py" .
grep -rn "mark_safe(" --include="*.py" .
Yes, for .html, .htm, and .xml template extensions rendered with render_template().