highScripts injected into your pages

HTML Built From Request Data Without Escaping

Text from the request is rendered as HTML.

Why it matters

Anything inserted as HTML is executed as HTML. If the text came from a form or a URL, that user can run script in every visitor's browser. Jinja and Django templates escape by default; the problem only appears when the HTML is built by hand or the escaping is switched off.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

Flask returning an f-string with the query value
@app.route('/hi')
def hi():
    name = request.args.get('name')
    return f"<h1>Hello {name}</h1>"

The smallest fix

minimal patch
# Flask: render a template file; Jinja escapes {{ name }} for you
return render_template("greet.html", name=request.args.get("name"))
# If you must build a string, escape the value
from markupsafe import escape
return f"<h1>Hello {escape(name)}</h1>"

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

safe alternative
# For user-supplied HTML (rich text, markdown), sanitise with bleach or
# nh3 before marking it safe, and send a Content-Security-Policy header
# so a slip cannot execute scripts.

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

In [the file] at line [the line number] request data is inserted into HTML: [the flagged code]. Move the markup into a template file so the engine escapes it, or wrap each value in markupsafe.escape. Never pass a formatted string to render_template_string, Markup or mark_safe. Add a test that submits "<img src=x onerror=alert(1)>" and asserts it is rendered inert.

How to check the fix worked

1. Submit "<img src=x onerror=alert(1)>" and view the page. No dialog
   must appear and the tag must be shown as text.
2. Confirm normal text still renders.

Further reading