add tempalte caching - #117
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+28
to
+35
| env=Environment( | ||
| loader=FileSystemLoader(TEMPLATES_DIR), | ||
| bytecode_cache=FileSystemBytecodeCache( | ||
| directory=TEMPLATES_CACHE_DIR, | ||
| pattern="%s.cache" | ||
| ), | ||
| auto_reload=True | ||
| ) |
Check warning
Code scanning / CodeQL
Jinja2 templating with autoescape=False Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 year ago
To fix this problem, configure the Jinja2 Environment instance to enable autoescaping for templates that may be served as HTML or XML. Jinja2 provides the select_autoescape utility, which automatically enables escaping on templates ending in .html, .htm, .xml, and other relevant extensions. The ideal fix is to pass autoescape=select_autoescape(['html', 'xml', 'j2']) when constructing the Environment. Thus, in api/routes/auth.py, update lines 27–36 to use:
from jinja2 import select_autoescape
...
templates = Jinja2Templates(
env=Environment(
loader=FileSystemLoader(TEMPLATES_DIR),
bytecode_cache=FileSystemBytecodeCache(
directory=TEMPLATES_CACHE_DIR,
pattern="%s.cache"
),
auto_reload=True,
autoescape=select_autoescape(['html', 'xml', 'j2'])
)
)Also ensure that select_autoescape is imported. Only lines relating to the Jinja2 environment creation (and the import) need editing; no other changes are necessary.
Suggested changeset
1
api/routes/auth.py
| @@ -12,7 +12,7 @@ | ||
| from fastapi.templating import Jinja2Templates | ||
| from authlib.common.errors import AuthlibBaseError | ||
| from authlib.integrations.starlette_client import OAuth | ||
| from jinja2 import Environment, FileSystemLoader, FileSystemBytecodeCache | ||
| from jinja2 import Environment, FileSystemLoader, FileSystemBytecodeCache, select_autoescape | ||
| from starlette.config import Config | ||
|
|
||
| from api.auth.user_management import validate_and_cache_user | ||
| @@ -31,7 +31,8 @@ | ||
| directory=TEMPLATES_CACHE_DIR, | ||
| pattern="%s.cache" | ||
| ), | ||
| auto_reload=True | ||
| auto_reload=True, | ||
| autoescape=select_autoescape(['html', 'xml', 'j2']) | ||
| ) | ||
| ) | ||
|
|
Copilot is powered by AI and may make mistakes. Always verify output.
gkorland
pushed a commit
that referenced
this pull request
Feb 22, 2026
switch from gpt-4o-mini to gpt-4o
gkorland
added a commit
that referenced
this pull request
Apr 4, 2026
- Bump litellm ~=1.82.0 → ~=1.83.0 (fixes CVE: auth bypass via OIDC cache key collision, privilege escalation via unrestricted proxy config) - Bump fastmcp >=2.13.1 → >=3.2.0 (fixes CVE: SSRF & path traversal in OpenAPI provider) - Add aiohttp>=3.13.4 constraint (fixes multiple HTTP-level CVEs: duplicate Host headers, header injection, multipart bypass, memory DoS, CRLF injection, cookie leaks, SSRF on Windows) - Add npm override for lodash-es to 4.18.1 (fixes prototype pollution via array path bypass, code injection via template imports) - Update fastmcp import path from deprecated fastmcp.server.openapi to fastmcp.server.providers.openapi Closes #125, #124, #123, #122, #121, #120, #119, #118, #117, #116, #115, #114, #113, #112, #111, #110, #109, #108, #107, #106, #105, #104, #103, #102, #101, #100, #99, #98, #97, #96 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
gkorland
added a commit
that referenced
this pull request
Aug 12, 2026
- Bump litellm ~=1.82.0 → ~=1.83.0 (fixes CVE: auth bypass via OIDC cache key collision, privilege escalation via unrestricted proxy config) - Bump fastmcp >=2.13.1 → >=3.2.0 (fixes CVE: SSRF & path traversal in OpenAPI provider) - Add aiohttp>=3.13.4 constraint (fixes multiple HTTP-level CVEs: duplicate Host headers, header injection, multipart bypass, memory DoS, CRLF injection, cookie leaks, SSRF on Windows) - Add npm override for lodash-es to 4.18.1 (fixes prototype pollution via array path bypass, code injection via template imports) - Update fastmcp import path from deprecated fastmcp.server.openapi to fastmcp.server.providers.openapi Closes #125, #124, #123, #122, #121, #120, #119, #118, #117, #116, #115, #114, #113, #112, #111, #110, #109, #108, #107, #106, #105, #104, #103, #102, #101, #100, #99, #98, #97, #96 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: galshubeli <124919062+galshubeli@users.noreply.github.com> Co-authored-by: gkorland <753206+gkorland@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.