python config_error ai_generated true

jinja2.exceptions.SecurityError: autoescape is disabled, but Markup is used

ID: python/flask-jinja-autoescape-off

Also available as: JSON · Markdown · 中文
80%Fix Rate
82%Confidence
0Evidence
2024-07-07First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
3.x active — — —

Root Cause

Using Markup or |safe on untrusted data with autoescape disabled, Jinja raises a security error in strict mode.

generic

中文

在自动转义禁用的情况下对不可信数据使用 Markup 或 |safe，Jinja 在严格模式下抛出安全错误。

Workarounds

  1. 93% success 
    app.jinja_env.autoescape = select_autoescape(['html', 'xml'])
  2. 90% success 
    Sanitize with bleach.clean(html, tags=[...]) before marking safe

Dead Ends

Common approaches that don't work:

  1. 50% fail

    Breaks legitimate HTML rendering; templates show escaped tags.

  2. 80% fail

    Unrelated setting; error persists.