Jinja: Autoescaping disabled by default is a dangerous default

Jinja is not only for HTML but a general-purpose template engine. I think most people use Jinja in Flask, which enables autoescape by default for HTML templates. If you integrate a template engine in your own framework, you are supposed to read the documentation on how to use it safely.

That said, I think being very clear in the docs that you should probably use autoescape when generating HTML is a good suggestion.

I would assume most major frameworks get this right (more eyes, less bugs, etc.) but there are also a lot of smaller projects integrating Jinja manually that do make this mistake.

And to be frank, Jinja's documentation is really poor on that subject. Here is what you first see when you open Jinja's documentation:

Jinja2 is a modern and designer-friendly templating language for Python, modelled after Django’s templates. It is fast, widely used and secure with the optional sandboxed template execution environment:

"modeled after Django's templates" and "secure" could lead to think it has Django's templates security features such as autoescaping.

Then, an example, which is HTML. And just after that, in the list of features:

powerful automatic HTML escaping system for XSS prevention

Which doesn't mention it's optional and not enabled by default.

The "Basic API usage" docs page doesn't show autoescaping enabled but it doesn't show HTML either, so I guess that's fine. But then when you go to the API "Basics" page:

from jinja2 import Environment, PackageLoader
env = Environment(loader=PackageLoader('yourapplication', 'templates'))
template = env.get_template('mytemplate.html')
print template.render(the='variables', go='here')

The first example is vulnerable to trivial XSSes. People are right to be confused.

Sounds like a good candidate for a pull request :)

We can't turn this off now without breaking everybody's code. I am however happy to update the docs accordingly. I will close this as a wontfix but feel free to open a PR for documentation updates.