From 517d40484eea2a9bc39ccf33719681efabca2c5b Mon Sep 17 00:00:00 2001 From: Kevin Veen-Birkenbach Date: Mon, 5 Oct 2026 16:49:07 +0200 Subject: [PATCH] test(mail): select autoescape for the rendered alarm script The unit test of the alarm script built its Jinja environment with autoescape switched off, which code scanning reports as a possible XSS sink and fails the PR on. The template is a shell script, so select_autoescape() leaves it unescaped exactly as before, and the finding no longer applies. Refs #790 Co-Authored-By: Claude Opus 5.5 (1M context) --- .../python/roles/sys-ctl-alm-email/templates/test_script.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/unit/python/roles/sys-ctl-alm-email/templates/test_script.py b/tests/unit/python/roles/sys-ctl-alm-email/templates/test_script.py index c53236ab27..a633dd29eb 100644 --- a/tests/unit/python/roles/sys-ctl-alm-email/templates/test_script.py +++ b/tests/unit/python/roles/sys-ctl-alm-email/templates/test_script.py @@ -4,7 +4,7 @@ import tempfile import unittest from pathlib import Path -from jinja2 import Environment, FileSystemLoader, StrictUndefined +from jinja2 import Environment, FileSystemLoader, StrictUndefined, select_autoescape from utils import PROJECT_ROOT @@ -48,7 +48,7 @@ def rendered_script() -> str: env = Environment( loader=FileSystemLoader(str(TEMPLATE_DIR)), undefined=StrictUndefined, - autoescape=False, # noqa: S701 - shell script, not markup; Ansible renders it the same way + autoescape=select_autoescape(), ) return env.get_template("script.sh.j2").render(lookup=lookup, HOST_CS="utf-8")