Fix Jinja2 autoescape disabled XSS vulnerability

[WiamSkakri]

Enable autoescape=True in the Jinja2 Environment to prevent cross-site scripting via user-controlled template variables. Flagged by Bandit (B701) and Semgrep.

What type of PR is this? (check all applicable)

• 🍕 Feature
• [ x ] 🐛 Bug Fix
• 📝 Documentation
• 🧑‍💻 Refactor
• ✅ Test
• 🤖 Build or CI
• ❓ Other (please specify)

Related Issue

No existing issue — vulnerability identified via static analysis scanning using Bandit and Semgrep.

Describe this PR

The Jinja2 Environment in backend/services/messaging/template_service.py was initialized without autoescape=True, which is Jinja2's default insecure configuration. This means any user-controlled data rendered in email templates (e.g. usernames, project names, comment content) could contain malicious HTML or JavaScript that would be rendered unescaped, leading to Cross-Site Scripting (XSS).

This PR adds autoescape=True to the Environment constructor, ensuring all template variables are HTML-escaped by default. All existing templates were reviewed and none use the | safe filter or Markup, so this change does not affect any existing rendering behaviour.

Flagged as High severity, High confidence by Bandit (B701: jinja2_autoescape_false) and as a Blocking finding by Semgrep (direct-use-of-jinja2).

Screenshots

N/A — backend-only change with no visual impact.

Alternative Approaches Considered

An alternative would be to use Jinja2's select_autoescape() helper to enable autoescape only for .html files. However, since all templates in this project are HTML email templates, enabling autoescape=True globally is simpler and equally correct.

Review Guide

1. Check that autoescape=True is set in the Environment constructor in backend/services/messaging/template_service.py
   Start the app with docker-compose up
2. Trigger an email notification (e.g. send a message between two users) and verify it renders correctly
3. Confirm the backend container remains healthy: docker-compose ps

Checklist before requesting a review

• 📖 Read the Tasking Manager Contributing Guide: https://github.com/hotosm/tasking-manager/blob/develop/docs/developers/contributing.md
• 📖 Read the HOT Code of Conduct: https://docs.hotosm.org/code-of-conduct
• 👷‍♀️ Create small PRs. In most cases, this will be possible.
• ✅ Provide tests for your changes.
• 📝 Use descriptive commit messages.
• 📗 Update any related documentation and include any relevant screenshots.
• 🔠 Does this PR introduce or change any environment variables? If so, make sure to specify this change in the description.

[optional] What gif best describes this PR or how it makes you feel?

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud