Enable auto-escaping for the consent templates

... to reduce the risk of somebody introducing an html injection attack...

1 files changed, 4 insertions, 1 deletions

diff --git a/synapse/rest/consent/consent_resource.py b/synapse/rest/consent/consent_resource.py

index 306385601c..e6a6dcbefa 100644
--- a/synapse/rest/consent/consent_resource.py
+++ b/synapse/rest/consent/consent_resource.py
@@ -114,7 +114,10 @@ class ConsentResource(Resource):
             )
 
         loader = jinja2.FileSystemLoader(consent_template_directory)
-        self._jinja_env = jinja2.Environment(loader=loader)
+        self._jinja_env = jinja2.Environment(
+            loader=loader,
+            autoescape=jinja2.select_autoescape(['html', 'htm', 'xml']),
+        )
 
         if hs.config.form_secret is None:
             raise ConfigError(