XSS prevention in templates in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output when rendering user input in a Flask template?

Consider a Flask template that displays a user-provided string using the standard Jinja2 syntax: {{ user_input }}. The user inputs the string <script>alert('XSS')</script>. What will the rendered HTML output be?

Flask

{{ user_input }}

A <script>alert('XSS')</script>

B &lt;script&gt;alert('XSS')&lt;/script&gt;

C &amp;lt;script&amp;gt;alert('XSS')&amp;lt;/script&amp;gt;

D alert('XSS')

💡 Hint

Think about how Jinja2 handles HTML special characters by default.

Jinja2 automatically escapes HTML special characters like < and > when rendering variables with {{ }}. So the user input is shown as escaped HTML entities, preventing the script from running.

📝 Syntax

intermediate

Which template syntax disables autoescaping in Flask?

In a Flask Jinja2 template, you want to display raw HTML from a variable html_content without escaping. Which syntax correctly disables autoescaping?

A {{ safe(html_content) }}

B {{ html_content|raw }}

C {{ html_content|safe }}

D {% raw html_content %}

💡 Hint

Look for the Jinja2 filter that marks content as safe.

The safe filter tells Jinja2 not to escape the content, rendering it as raw HTML. Other options are invalid syntax or filters.

🔧 Debug

advanced

Why does this Flask template allow XSS despite using {{ }}?

Given the Flask template snippet:

{{ user_input|safe }}

The user_input contains <script>alert('XSS')</script>. Why does this cause an XSS vulnerability?

A The safe filter encodes the script tag, preventing execution.

B The {{ }} syntax always escapes content, so no XSS is possible.

C The user_input is sanitized automatically by Flask before rendering.

D The safe filter disables escaping, so the script tag is rendered as HTML and runs.

💡 Hint

Consider what the safe filter does to the output.

The safe filter disables Jinja2's automatic escaping, so any HTML or script tags in the variable are rendered directly. This allows malicious scripts to run if user input is not sanitized.

🧠 Conceptual

advanced

How does Flask's autoescaping protect against XSS?

Which statement best describes how Flask's Jinja2 template autoescaping helps prevent XSS attacks?

A It converts special HTML characters in variables to safe entities, so scripts are not executed.

B It removes all HTML tags from user input before rendering.

C It encrypts user input before displaying it in the browser.

D It disables JavaScript execution in the browser automatically.

💡 Hint

Think about what happens to characters like < and > in output.

Autoescaping replaces characters like < and > with HTML entities like < and >, so browsers display them as text, not as HTML tags, preventing script execution.

❓ state_output

expert

What is the rendered output of this Flask template with mixed safe and unsafe variables?

Given the Flask template:

User comment: {{ comment }}
Admin note: {{ admin_note|safe }}

And the variables:

• comment = "<b>Hello</b>"
• admin_note = "<i>Important</i>"

What is the exact rendered HTML output?

A User comment: &lt;b&gt;Hello&lt;/b&gt;<br>Admin note: <i>Important</i>

B User comment: <b>Hello</b><br>Admin note: &lt;i&gt;Important&lt;/i&gt;

C User comment: <b>Hello</b><br>Admin note: <i>Important</i>

D User comment: &lt;b&gt;Hello&lt;/b&gt;<br>Admin note: &lt;i&gt;Important&lt;/i&gt;

💡 Hint

Remember which variables are escaped and which are marked safe.

The comment variable is autoescaped, so HTML tags appear as entities. The admin_note is marked safe, so its HTML tags render normally.