Description

This detector identifies Django applications vulnerable to reflected cross-site scripting (XSS) attacks. It finds locations where user-controlled input is returned in HTTP responses without proper escaping, allowing attackers to inject malicious scripts that execute in victims' browsers.

Detection Strategy

• Scans Python files that import Django framework libraries

• Identifies HTTP response functions (like HttpResponse, render) and HTML escape bypass functions (like mark_safe, Markup)

• Checks if these functions receive user-controlled input (from request parameters, form data, etc.) without proper sanitization

• Reports vulnerabilities when user input flows directly into HTTP responses or when safe/trusted markup functions are used with untrusted data

• Specifically examines the content_type parameter and argument positions to determine if response content could contain unescaped user data

Vulnerable code example

from django.http import HttpResponse
from django.utils.html import mark_safe

def vuln_get_positional(request):
    # VULNERABLE: User input rendered as HTML without escaping
    q = request.GET.get("q", "")
    return HttpResponse(q)
...

✅ Secure code example

from django.http import HttpResponse
from django.utils.html import escape, format_html

def safe_get_positional(request):
    # SAFE: escape() prevents XSS by encoding dangerous characters
    q = escape(request.GET.get("q", ""))
    return HttpResponse(q)
...