Python plays a central role in modern computing, yet Python applications are not immune to cybersecurity threats. As a result, security has become a critical concern for developers and users alike.
When building Python Code Audit, a tool designed to detect weaknesses in Python code, one of my core principles was to create a simpler Static Application Security Testing (SAST) scanner.
Simplicity is better than complexity for good security, and the way results are presented matters deeply.
This is precisely why I chose a plain HTML output for the CLI version of Python Code Audit.
Security Tools Shouldn’t Introduce Risk
Using security tools to validate your systems and applications should never introduce extra weaknesses or vulnerabilities into your landscape. However, many popular cybersecurity tools actually put you at risk when you run them.
Since Python Code Audit uses HTML to display code snippets, you can rest assured that if malware is found in a Python file, it cannot harm you.
Python Code Audit never executes Python programs (or any part of them) to determine a weakness. Instead, we use a proven, safe method of analysing source code by using the Python Abstract Syntax Tree (AST).
Neutralising HTML and XSS Injections
A prevalent issue in many security applications is serving untrusted HTML inside a report. For security scanners, this is a flaw that must be prevented at all times.
To combat this, Python Code Audit displays code snippets strictly as text. This prevents malicious content embedded in code strings or comments from being interpreted as HTML in the browser.
We achieve this by routing the text through standard Python functionality:
import html
html.escape(code_snippet)This converts special characters into HTML-safe entities, so dangerous characters are safely neutralised:
- < becomes <
- > becomes >
- & becomes &
Context Matters
Using html.escape() protects against HTML injection. To be clear, it does not sanitise the underlying possible malicious Python (which isn’t necessary just for displaying it), nor does it prevent every complex flavour of XSS possible in full-blown HTML files loaded with JavaScript and CSS. So use html.escape() with care.
In security, context is everything. So for our use case applying html.escape() is sufficient. This since our only goal here is to display a few plain lines of Python source code in a simple, highly trusted HTML output. By keeping the output minimalist and properly escaped, Python Code Audit keeps your workflow completely secure.
