Securing response data
Jinja2 has a built-in escaping mechanism to avoid SSTIs. SSTIs allow attackers to inject malicious template scripts or fragments that can run in the background. These then ruin the response or perform unwanted executions that can ruin server-side operations. Thus, applying the safe filter in Jinja templates to perform dynamic content augmentation is not a good practice. The safe filter turns off the Jinja2’s escaping mechanism and allows for running these malicious attacks. In connection with this, avoid using dynamic hypertext links using the <a> tag in templates (e.g., <a href="{{ var_link }}">Click Me</a>). Instead, utilize the url_for() utility method to call dynamic view functions because it validates and checks whether the Jinja variable in the expression is a valid view name. Chapter 1 discusses how to apply url_for() for hyperlinks.
On the other hand, there are also issues in Flask that need handling to prevent injection...
