Template engines, such as Twig, Django, and Jinja2, provide automatic escaping of template variables to prevent cross-site scripting (XSS) attacks, but this protection can be explicitly disabled.
Template engines provide auto-escaping as a safety mechanism that transforms HTML special characters in variable output before rendering,
preventing user-controlled input from being interpreted as HTML or JavaScript by the browser. Disabling this protection — through settings like
autoescape: false, escape-bypass filters like |safe, or equivalent configuration — allows untrusted input to pass through
unmodified and be executed by the browser as markup or script.
When auto-escaping is disabled, an attacker who can control the content of template variables can inject malicious HTML or JavaScript into pages served to other users. An attacker could steal session tokens, redirect users to phishing pages, or perform unauthorized actions on behalf of the victim.
The following examples configure the template engine to disable its auto-escaping feature, allowing template variables to be rendered without HTML encoding.
<!-- Django templates -->
<p>{{ variable|safe }}</p><!-- Noncompliant -->
{% autoescape off %}<!-- Noncompliant -->
<!-- Django templates -->
<p>{{ variable }}</p>
{% autoescape on %}
The following examples configure the template engine to disable its auto-escaping feature, allowing template variables to be rendered without HTML encoding.
<!-- Jinja2 templates -->
<p>{{ variable|safe }}</p><!-- Noncompliant -->
{% autoescape false %}<!-- Noncompliant -->
<!-- Jinja2 templates -->
<p>{{ variable }}</p>
{% autoescape true %}