From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Tue, 18 Aug 2015 15:10:46 +0000 (+0200)
Subject: Enable auto-escaping templates
X-Git-Tag: v1.1.0~42
X-Git-Url: http://git.cascardo.info/?p=cascardo%2Fipsilon.git;a=commitdiff_plain;h=a503aa9c2a30a74e709d1c88099befd50fb2eb16;hp=826e6339441546f596320f3d73304ab5f7c10de6

Enable auto-escaping templates

This will prevent most cases of insertion of HTML or other
code into the generated HTML.

Fixes: CVE-2015-5215

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Rob Crittenden <rcritten@redhat.com>
---

diff --git a/ipsilon/ipsilon b/ipsilon/ipsilon
index a0cc158..bec13af 100755
--- a/ipsilon/ipsilon
+++ b/ipsilon/ipsilon
@@ -60,7 +60,9 @@ else:
 template_loaders.append(FileSystemLoader(
     os.path.join(cherrypy.config['base.dir'],
                  default_template_dir)))
-template_env = Environment(loader=ChoiceLoader(template_loaders))
+template_env = Environment(loader=ChoiceLoader(template_loaders),
+                           autoescape=True,
+                           extensions=['jinja2.ext.autoescape'])
 
 if __name__ == "__main__":
     conf = {'/': {'tools.staticdir.root': os.getcwd()},