Replace author + organize CLI #907
Conversation
* create a CLI for generating item.yaml and organize the CLI directory * modify comments to module * PR fixes * Update cli/common/generate_item_yaml.py Co-authored-by: Eyal Danieli <eyal_danieli@mckinsey.com> --------- Co-authored-by: Eyal Danieli <eyal_danieli@mckinsey.com>
| } | ||
|
|
||
| # Load and render template | ||
| env = Environment(loader=FileSystemLoader(".")) |
Check failure
Code scanning / CodeQL
Jinja2 templating with autoescape=False High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 8 months ago
To resolve the issue, we should explicitly enable autoescaping when creating the Jinja2 Environment. The best practice is to use autoescape=select_autoescape([...]), allowing Jinja2 to select auto-escapers for formats where it makes sense (such as HTML or XML), and disable for others (like YAML). However, since YAML is not recognized by select_autoescape by default, specifying autoescape=True could unintentionally escape all fields, leading to undesirable results in the YAML output (e.g., character encoding in strings). Instead, adopting autoescape=select_autoescape() is the recommended approach, as it will safely apply autoescaping only if/when templates change to support formats like HTML/XML. To use select_autoescape, we need to import it explicitly from Jinja2.
Therefore:
- Add
from jinja2 import select_autoescapeto the imports. - Change the
Environment(...)constructor to passautoescape=select_autoescape().
All changes will be in cli/common/generate_item_yaml.py.
| @@ -2,7 +2,7 @@ | ||
| from pathlib import Path | ||
| from datetime import datetime | ||
| import click | ||
| from jinja2 import Environment, FileSystemLoader | ||
| from jinja2 import Environment, FileSystemLoader, select_autoescape | ||
|
|
||
| TEMPLATES = { | ||
| "function": "cli/utils/function_item_template.yaml.j2", | ||
| @@ -43,7 +43,7 @@ | ||
| } | ||
|
|
||
| # Load and render template | ||
| env = Environment(loader=FileSystemLoader(".")) | ||
| env = Environment(loader=FileSystemLoader("."), autoescape=select_autoescape()) | ||
| template = env.get_template(TEMPLATES[type]) | ||
| rendered = template.render(params) | ||
|
|
authorinitem.yaml#905