unescaped-user-input-with-safe.yaml

rules:
- id: user-input-escaped-with-safe
  mode: join
  join:
    refs:
    - rule: https://raw.githubusercontent.com/minusworld/semgrep-library/main/rules/flask/flask-user-input.yaml
      as: user-input
    - rule: https://raw.githubusercontent.com/minusworld/semgrep-library/main/rules/flask/render-template-input.yaml
      as: render-template-input
    - rule: https://raw.githubusercontent.com/minusworld/semgrep-library/main/rules/flask/template-var-safe.yaml
      renames:
      - from: '$...EXPR'
        to: '$VAR'
      as: template-vars
    on:
    - 'user-input.$VAR == render-template-input.$INPUT'
    - 'render-template-input.$VAR == template-vars.$VAR'
    - 'render-template-input.$TEMPLATE ~ template-vars.path'
  message: >-
    The variable '$VAR' is most likely an XSS. It originates as user input
    and is unsafely rendered with the '| safe' filter.
  severity: ERROR