From fe1758bcf8577435f622ae2d1bf36976f1fd3bf5 Mon Sep 17 00:00:00 2001
From: Nikolaus Schuetz <nikolauspschuetz@gmail.com>
Date: Sat, 27 Jun 2026 11:01:21 -0700
Subject: [PATCH] [flake8-bandit] Fix misleading docstring for mako-templates
 (S702)

The "Use instead" example was Template("hello |h"), which demonstrates
nothing: mako's |h filter applies to a variable expression (${ data |h }),
so "hello |h" is just a literal string. It contradicted the rule's own
prose ("to HTML escape the variable data, use ${ data |h }").

- Rework both examples to show the escaping contrast on a variable, with
  inline comments matching the convention in sibling rules (e.g.
  unsafe_markup_use's `# XSS` / `# Safe`):
    bad:  Template("${ data }")      # Unescaped: vulnerable to XSS.
    good: Template("${ data |h }")   # HTML-escaped with the `h` filter.
- Drop `n` from the list of "sanitizing" filters in the rationale: mako's
  `n` filter disables default filtering, so it cannot sanitize. Keep the
  accurate `h` (HTML) and `x` (XML) escaping filters.
---
 .../src/rules/flake8_bandit/rules/mako_templates.rs       | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/crates/ruff_linter/src/rules/flake8_bandit/rules/mako_templates.rs b/crates/ruff_linter/src/rules/flake8_bandit/rules/mako_templates.rs
index 32f695263cad95..8d963335ec3e78 100644
--- a/crates/ruff_linter/src/rules/flake8_bandit/rules/mako_templates.rs
+++ b/crates/ruff_linter/src/rules/flake8_bandit/rules/mako_templates.rs
@@ -11,21 +11,21 @@ use crate::checkers::ast::Checker;
 /// ## Why is this bad?
 /// Mako templates allow HTML and JavaScript rendering by default, and are
 /// inherently open to XSS attacks. Ensure variables in all templates are
-/// properly sanitized via the `n`, `h` or `x` flags (depending on context).
-/// For example, to HTML escape the variable `data`, use `${ data |h }`.
+/// properly escaped via the `h` (HTML) or `x` (XML) filters, depending on
+/// context. For example, to HTML escape the variable `data`, use `${ data |h }`.
 ///
 /// ## Example
 /// ```python
 /// from mako.template import Template
 ///
-/// Template("hello")
+/// Template("${ data }")  # Unescaped: vulnerable to XSS.
 /// ```
 ///
 /// Use instead:
 /// ```python
 /// from mako.template import Template
 ///
-/// Template("hello |h")
+/// Template("${ data |h }")  # HTML-escaped with the `h` filter.
 /// ```
 ///
 /// ## References