Home / Companies / Semgrep / Blog / Post Details
Content Deep Dive

Bento 0.9: Checks for a high-severity Python vulnerability and Jinja templates

Blog post from Semgrep

Post Details
Company
Date Published
Author
Pablo Estrada
Word Count
361
Language
English
Hacker News Points
-
Summary

Bento version 0.9 introduces important security features, including a check for a high-severity Python vulnerability CVE-2020-8492, which involves regex denial of service (ReDoS) and can be run on codebases using the Dlint tool. This vulnerability previously caused a significant outage for Cloudflare in 2019. The update also adds checks for Jinja, Flask's HTML template engine, focusing on preventing cross-site scripting (XSS) by ensuring proper text escaping and the inclusion of noreferrer and noopener attributes. Additionally, Bento is developing a GitHub Action, inviting early users to provide feedback and support for its integration. Users are encouraged to upgrade to the latest version via pip and to reach out for support or discussion through email or Slack.