Code RoomMarkup wraps untrusted HTML

HardPrep Room Coding #1660

Markup wraps untrusted HTML

Code reviewSecuritySenior–Staff~25 min

Review this Python (Jinja2) profile renderer used in a server-rendered app.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 25 min

Mark a line and say what kind of problem it is.0 findings

1from markupsafe import Markup

2

3def render_bio(user):

4 # bio is user-supplied markdown converted to HTML elsewhere

5 html = markdown_to_html(user.bio_md)

6 return Markup(

7 '<div class="bio">' + html + '</div>'

8 )

9

10# template: {{ render_bio(current_user_viewing) | safe }}

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.