Treat all client-supplied data—HTTP headers (e.g. Host), query/path parameters, form data—as untrusted, and enforce strict validation or escaping before using it in security-sensitive contexts such as generating URLs or rendering HTML. Mitigations must be mandatory, correctly scoped, and precisely described rather than presented as optional suggestions.
For host-derived URLs, Flask always builds external URLs (url_for(..., _external=True)) from the request’s Host header. Don’t describe this as a “default” behavior—state clearly that it always happens. To protect against Host header injection, require the global TRUSTED_HOSTS configuration (not the per-request Request.trusted_hosts attribute, which only overrides the global setting for that request) and document it as something you must configure, not something to “consider”:
app.config["TRUSTED_HOSTS"] = ["example.com"]
For user-controlled values rendered in responses, always escape them to prevent XSS, and keep example code self-contained (including necessary imports):
from markupsafe import escape
@app.route('/user/<username>')
def profile(username):
return '{}\'s profile'.format(escape(username))
When writing security documentation or code, be explicit and directive: state exactly when input is untrusted, which configuration or escaping mechanism actually mitigates the risk, and require its use rather than merely recommending it.</description>