title: Python Flask XSS Neutralization (Veracode alert)
body: <p>Hi have the following piece of code that triggers an alert on Veracode:</p>
  
  <pre><code>@app.route('/user/&lt;username&gt;', methods=['GET'])
  @login_required
  def user(username):
      username = str(escape(username))
      if current_user.username == username:
          user = User.query.filter_by(username=username).first_or_404()
          all_regions = Region.query.all()
          return render_template('user_bs.html', user=user, all_regions=all_regions,
                                 production_mode=app.config['PRODUCTION_MODE'],
                                 manual_registration=app.config['AUTHENTICATION_METHODS']['MANUAL'])
      return redirect(url_for('index'))
  </code></pre>
  
  <p>I'm trying to understand what I can do to neutralize it.</p>
  
  <p>In the <strong>user_bs.html</strong> template I'm properly surrounding my variables with curly brackets, double quotes etc...
  What else can i do to prevent XSS?</p>
  
  <p>This is the template:</p>
  
  <pre><code>{% extends "base.html" %}
  
  {% block app_content %}
  &lt;div&gt;
      &lt;table class="table"&gt;
          &lt;h3&gt;My Profile&lt;/h3&gt;
      &lt;tr &gt;
          &lt;td&gt;
              &lt;h1&gt;&lt;img src="{{ user.avatar(32) }}"&gt; {{ user.fullname }} &lt;/h1&gt;
              &lt;p&gt;Info: {{ user.description }}&lt;/p&gt;
              &lt;p&gt;Username: {{ user.username }}&lt;/p&gt;
              &lt;p&gt;Role: {% for role in user.roles %} {{ role }} {% endfor %}&lt;/p&gt;
              &lt;p&gt;Email: {{ user.email }}&lt;/p&gt;
              &lt;p&gt;Creation date: {{ user.creation_dt }}&lt;/p&gt;
              {% if user.last_seen %}&lt;p&gt;Last seen on: {{ user.last_seen }}&lt;/p&gt;{% endif %}
          &lt;/td&gt;
      &lt;/tr&gt;
      &lt;/table&gt;
  &lt;/div&gt;
  {% endblock %}
  </code></pre>
  
  <p>And <strong>base.html</strong>:</p>
  
  <pre><code>{% extends 'bootstrap/base.html' %}
  
  {% block title %}
      {% if title %}{{ title }}
      {% elif frontend %} {{ frontend.name }} - test
      {% else %} test
      {% endif %}
  {% endblock %}
  
  {% block head %}
  &lt;meta charset="UTF-8"&gt;
  {{super()}}
  &lt;link rel="icon" type="image/png" href="{{url_for('static', filename='images/favicon.ico')}}"&gt;
  &lt;link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/animate.css/3.7.0/animate.min.css"&gt;
  {% endblock %}
  {% block navbar %}
  &lt;div id="main"&gt;
      &lt;nav class="navbar navbar-default"&gt;
          &lt;div class="container-fluid"&gt;
              &lt;div class="navbar-header"&gt;
                  &lt;button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#bs-example-navbar-collapse-1" aria-expanded="false"&gt;
                      &lt;span class="sr-only"&gt;Toggle navigation&lt;/span&gt;
                      &lt;span class="icon-bar"&gt;&lt;/span&gt;
                      &lt;span class="icon-bar"&gt;&lt;/span&gt;
                      &lt;span class="icon-bar"&gt;&lt;/span&gt;
                  &lt;/button&gt;
                  &lt;a class="navbar-brand" href="{{ url_for('index') }}"&gt;&lt;img src="{{url_for('static', filename='images/logo_navbar.png')}}" width="90px" alt="test" /&gt;&lt;/a&gt;
                  {% if frontend %}
                      {% if frontend.analytics %}
                          &lt;button id='toggle_analytics' class="btn btn-default navbar-btn active"&gt;&lt;span class="glyphicon glyphicon-signal"&gt;&lt;/span&gt;&amp;nbsp Dashboard&lt;/button&gt;
                          &lt;button id='toggle_filters' class="btn btn-default navbar-btn"&gt;&lt;span class="glyphicon glyphicon-tasks"&gt;&lt;/span&gt;&amp;nbsp Reports&lt;/button&gt;
                      {% else %}
                          &lt;button id='toggle_filters' class="btn btn-default navbar-btn active"&gt;&lt;span class="glyphicon glyphicon-tasks"&gt;&lt;/span&gt;&amp;nbsp Reports&lt;/button&gt;
                      {% endif %}
                  {% endif %}
              &lt;/div&gt;
              &lt;ul class="nav navbar-nav"&gt;
                  {% if frontends|length &gt; 0 %}
                      {% for region in regions|sort(attribute='name') %}
                          {% set prod_lst = [] %}
                          {% for frontend in frontends %}
                              {% if frontend.region == region and frontend.activate %}
                                 {% set prod_lst = prod_lst.append(frontend.product) %}
                              {% endif %}
                          {% endfor %}
                              &lt;li class="dropdown"&gt;
                                  &lt;a href="#" class="dropdown-toggle" data-toggle="dropdown" role="button" aria-haspopup="true" aria-expanded="false"&gt;{{ region.name }} &lt;span class="caret"&gt;&lt;/span&gt;&lt;/a&gt;
                                  &lt;ul class="dropdown-menu"&gt;
                                      {% for product in products|sort(attribute='name') %}
                                      {% if product in prod_lst %}
                                                  &lt;h6 class="dropdown-header"&gt;{{ product.name }}&lt;/h6&gt;
                                          {% for frontend in frontends|sort(attribute='name') %}
                                              {% if frontend.region == region and frontend.product == product %}
                                                  {% if frontend.activate %}
                                                      &lt;li&gt;&lt;a href="{{ url_for('dashboard', product_code=frontend.product.product_code, frontend_code=frontend.frontend_code) }}"&gt;{{ frontend.name }}&lt;/a&gt;&lt;/li&gt;
                                                  {% endif %}
                                              {% endif %}
                                          {% endfor %}
                                      {% endif %}
                                  {% endfor %}
                                  &lt;/ul&gt;
                              &lt;/li&gt;
                      {% endfor %}
                  {% endif %}
                  &lt;/ul&gt;
                  &lt;div class="collapse navbar-collapse" id="bs-example-navbar-collapse-1"&gt;
                      &lt;ul class="nav navbar-nav navbar-right"&gt;
                          {% if frontend %}
                              &lt;p class="navbar-text align-right animated fadeInLeftBig animation-duration-500ms delay-3s" align="right"&gt; {{ frontend.name }} :: &lt;span class="glyphicon glyphicon-time"&gt;&lt;/span&gt; {{ frontend.timezone.name }} :: &lt;span id="clock"&gt;&lt;/span&gt; &lt;/p&gt;
                          {% else %}
                              &lt;p class="navbar-text align-right animated fadeIn animation-duration-500ms" align="right"&gt;&lt;span id="clock"&gt;&lt;/span&gt; &lt;/p&gt;
                          {% endif %}
                          {% if current_user.is_anonymous %}
                              &lt;li&gt;&lt;a href="{{ url_for('login') }}"&gt;Login&lt;/a&gt;&lt;/li&gt;
                          {% else %}
                              &lt;li&gt;&lt;a href="{{ url_for('index') }}"&gt;&lt;span class="glyphicon glyphicon-home"&gt;&lt;/span&gt;&lt;/a&gt;&lt;/li&gt;
                              &lt;li&gt;&lt;a href="{{ url_for('user', username=current_user.username) }}" title="Profile {{ current_user.username }}"&gt;&lt;span&gt;&lt;img src="{{ current_user.avatar(20) }}"&gt;&lt;/span&gt;&lt;/a&gt;&lt;/li&gt;
                              {% if current_user.roles[0].name == 'Admin' %}
                                  &lt;li&gt;&lt;a href="{{ url_for('admin.index') }}"&gt; &lt;span class="glyphicon glyphicon-cog"&gt;&lt;/span&gt; &lt;/a&gt;&lt;/li&gt;
                              {% endif %}
                              &lt;li&gt;&lt;a href="{{ url_for('logout') }}" title="Logout"&gt; &lt;span class="glyphicon glyphicon-log-out"&gt;&lt;/span&gt;&lt;/a&gt;&lt;/li&gt;
                          {% endif %}
                      &lt;/ul&gt;
                  &lt;/div&gt;
  
          &lt;/div&gt;
      &lt;/nav&gt;
  {% endblock %}
  
  {% block content %}
      &lt;div class="container-fluid animated fadeIn animation-duration-100ms"&gt;
          {% block app_content %}
          {% endblock %}
      &lt;/div&gt;
  &lt;/div&gt;
  {{super()}}
  {%- block footer %}
  &lt;footer class="text-center"&gt;&amp;copy; 2019 test&lt;/footer&gt;
  {%- endblock footer %}
  {% endblock content%}
  {% block scripts %}
  {{super()}}
  &lt;script src="{{url_for('static', filename='js/animate/custom.js')}}"&gt;&lt;/script&gt;
  {% endblock %}
  </code></pre>