python/flask: catch inline render_template_string() calls in dangerous-template-string

[shmulc8]

What

dangerous-template-string requires the template to be assigned to a variable before the call, so a template formatted inline at the call site is missed entirely:

# not flagged today
return flask.render_template_string(f"<h1>{request.url}</h1>")

All eight existing patterns are of the form $V = <formatted> ... render_template_string($V). This adds four that match the call expression itself — f-string, .format, %, concatenation. Matching the expression also covers return render_template_string(...), 404 for free, which is why the existing set needs two entries per formatting style.

The commented-out test

dangerous-template-string.py carries an error3 case commented out as ## Doesn't work yet. The assignment-plus-f-string form it describes is matched today; the block could never have passed because f'''{ extends "layout.html" }''' is not valid Python — the braces are parsed as f-string expressions. Rewritten with escaped braces so it parses, and enabled.

Tests

Five vulnerable cases and two # ok: cases added. The # ok: half is deliberate: it pins the rule against being widened into flagging every render_template_string call, which flask/security/audit/render-template-string already does at WARNING.

semgrep --test passes 1/1 on the rule.

[CLAassistant]

All committers have signed the CLA.

[semgrep-code-dev-returntocorp]

Semgrep found 6 render-template-string findings:

• python/flask/security/dangerous-template-string.py
  • L42 - Triage
  • L66 - Triage
  • L71 - Triage
  • L76 - Triage
  • L81 - Triage
  • L86 - Triage

Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks.

[shmulc8]

For what it is worth, the whole rule also collapses into an allowlist:

  patterns:
  - pattern: flask.render_template_string($X, ...)
  - pattern-not: flask.render_template_string("...", ...)

It covers the same cases plus render_template_string(tpl) where tpl came from a function call, which none of the current patterns reach. The cost is that it anchors findings on the call line rather than the assignment line, which relocates four existing findings and needs four test annotations moved. Kept this PR as the targeted fix instead; happy to switch if you prefer that trade.