configure Jinja autoescaping by template type to avoid Markup usage …

[UlrichB22]

…for XML

Disable Jinja autoescaping for .xml templates, keep it enabled for HTML.
This allows rendering pre-escaped XML output without using markupsafe.Markup
and avoids Bandit warnings B701/B704.

Related to #1858.

[roland-ruedenauer]

Disabling Jinja autoescaping for XML templates would work as there is only a limited number of uses in Moin. Nevertheless, it seems not to be recommended.

An alternative solution woud be to make use of a baseline file to suppress reporting of already validated uses of Markup() or other bandit findings.

Function escape should be added to allowed_calls in section markupsafe_css.

[UlrichB22]

Thanks for your review.

An alternative solution woud be to make use of a baseline file to suppress reporting of already validated uses of Markup() or other bandit findings.

IMO using baselines only hides the problems. I prefer to keep them visible in the code.

I am working on a general solution for Markup and will close this PR later.

[UlrichB22]

Replaced by #2151