Fix Jinja2 template rendering with autoescape enabled (#690)

* add autoescape true * Update initial_commit.py with space * Update initial_commit.py Add autoescape=True to avoid XSS
awslabs · May 27, 2024 · 0775e24 · 0775e24
1 parent 84e7831
commit 0775e24
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/...trap_repository/adf-bootstrap/deployment/lambda_codebase/initial_commit/initial_commit.py b/...trap_repository/adf-bootstrap/deployment/lambda_codebase/initial_commit/initial_commit.py
@@ -476,7 +476,7 @@ def get_files_to_commit(directory_path: Path) -> List[FileToCommit]:
 def create_adf_config_file(props: CustomResourceProperties) -> FileToCommit:
     template = HERE / "adfconfig.yml.j2"
     adf_config = (
-        jinja2.Template(template.read_text(), undefined=jinja2.StrictUndefined)
+        jinja2.Template(template.read_text(), undefined=jinja2.StrictUndefined , autoescape=True)
         .render(vars(props))
         .encode()
     )

diff --git a/src/lambda_codebase/initial_commit/initial_commit.py b/src/lambda_codebase/initial_commit/initial_commit.py
@@ -521,7 +521,7 @@ def create_adf_config_file(
 ) -> FileToCommit:
     template = HERE / input_file_name
     adf_config = (
-        jinja2.Template(template.read_text(), undefined=jinja2.StrictUndefined)
+        jinja2.Template(template.read_text(), undefined=jinja2.StrictUndefined, autoescape=True)
         .render(vars(props))
         .encode()
     )