google--adk-python

Files

T

k4w_wak a721c1eb34 fix(security): enable Jinja2 autoescape to prevent XSS in gepa sample

Merge https://github.com/google/adk-python/pull/5526

## Security Fix: XSS via Jinja2 Template Injection (CWE-79)

### Vulnerability
`contributing/samples/gepa/rater_lib.py` instantiates `jinja2.Environment()` **without** `autoescape=True`. The companion template `rubric_validation_template.txt` renders `{{user_input}}` and `{{model_response}}` without escaping.

### Impact
Since ADK is Google's official framework for building AI agents, developers copy/adapt this sample code into production web applications. Unescaped user-controlled input in Jinja2 templates enables:

- **Cross-Site Scripting (XSS)** — Arbitrary JavaScript execution in browsers
- **Session Hijacking** — Steal cookies/tokens if rendered in web context
- **Phishing** — Inject fake login forms

### Proof of Concept
```python
# user_input: <script>alert("XSS")</script>
# Renders as: <main_prompt><script>alert("XSS")</script></main_prompt>

# model_response: <img src=x onerror=alert("XSS from model")>
# Renders as: <responses><img src=x onerror=alert("XSS from model")></responses>
```

### Changes
1. **rater_lib.py:170** — `jinja2.Environment()` → `jinja2.Environment(autoescape=True)`
2. **rubric_validation_template.txt:158** — `{{user_input}}` → `{{user_input|e}}`
3. **rubric_validation_template.txt:163** — `{{model_response}}` → `{{model_response|e}}`

Defense in depth: `autoescape=True` provides baseline protection, explicit `|e` filters ensure escaping even if autoescape is later disabled.

### References
- CWE-79: Cross-site Scripting (XSS)
- OWASP A7:2017 — Cross-site Scripting
- Jinja2 docs: https://jinja.palletsprojects.com/en/3.1.x/api/#autoescaping

Co-authored-by: Shangjie Chen <deanchen@google.com>
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/adk-python/pull/5526 from k4w-wak:fix/jinja2-xss-autoescape b5b6d3eee616aa95c6a06ced4053fdc0745d5e0a
PiperOrigin-RevId: 943549514

2026-07-06 16:17:10 -07:00

agent_registry_agent

chore: switch main to v2.0.0 GA (transition to v2)

2026-05-19 02:01:33 +00:00

antigravity_agent

feat(labs): add experimental Antigravity SDK agent wrapper

2026-06-11 13:42:11 -07:00

api_registry_agent

chore: switch main to v2.0.0 GA (transition to v2)

2026-05-19 02:01:33 +00:00

application_integration_agent

chore: switch main to v2.0.0 GA (transition to v2)