From 5085b20b29f5b35bf841cc8caff5dff99329fcc1 Mon Sep 17 00:00:00 2001 From: etserend Date: Wed, 21 Oct 2026 11:39:05 -0500 Subject: [PATCH] fix(examples): enable select_autoescape in Jinja2 environments (VULN-115241) Co-Authored-By: Claude Code --- .../agent_framework/prompts/templates.py | 1 + .../weather-vibes-agent/agent/weather_vibes_agent.py | 9 +++++++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/examples/agent/startup-simulator-3000/agent_framework/prompts/templates.py b/examples/agent/startup-simulator-3000/agent_framework/prompts/templates.py index ddbeeb24..2dc93549 100644 --- a/examples/agent/startup-simulator-3000/agent_framework/prompts/templates.py +++ b/examples/agent/startup-simulator-3000/agent_framework/prompts/templates.py @@ -9,6 +9,7 @@ class PromptTemplate: def __init__(self, template_path: str): self.env = jinja2.Environment( loader=jinja2.FileSystemLoader(Path(__file__).parent / "templates"), + autoescape=jinja2.select_autoescape(["html", "xml"]), trim_blocks=True, lstrip_blocks=True, ) diff --git a/examples/agent/weather-vibes-agent/agent/weather_vibes_agent.py b/examples/agent/weather-vibes-agent/agent/weather_vibes_agent.py index 72c53e56..6e3890ee 100644 --- a/examples/agent/weather-vibes-agent/agent/weather_vibes_agent.py +++ b/examples/agent/weather-vibes-agent/agent/weather_vibes_agent.py @@ -8,7 +8,7 @@ import sys from pathlib import Path from typing import Dict, Any -from jinja2 import Environment, FileSystemLoader +from jinja2 import Environment, FileSystemLoader, select_autoescape from agent_framework.agent import Agent from agent_framework.state import AgentState @@ -90,7 +90,12 @@ def __init__(self, agent_id: str = "weather_vibes"): # Set up template environment template_dir = Path(__file__).parent.parent / "templates" - self.template_env = Environment(loader=FileSystemLoader(template_dir), trim_blocks=True, lstrip_blocks=True) + self.template_env = Environment( + loader=FileSystemLoader(template_dir), + autoescape=select_autoescape(["html", "xml"]), + trim_blocks=True, + lstrip_blocks=True, + ) # Set up OpenAI client instead of OpenAIChat self.client = OpenAI(api_key=os.getenv("OPENAI_API_KEY"))