Merge pull request #151 from fosslight/vuln

Fix the snyk vulnerability

src/fosslight_prechecker/_add.py

@@ -303,7 +303,7 @@ def find_representative_license(path_to_find, input_license):
  logger.info(f"\n - Representative license : {input_license}")
 
  parsed_args = main_parser.parse_args(['download', f"{input_license}"])
-
+ input_license = input_license.replace(os.path.sep, '')
  try:
  # 0: successfully downloaded, 1: failed to download
  reuse_return_code = reuse_download(parsed_args, prj)

src/fosslight_prechecker/_add_header.py

@@ -17,15 +17,13 @@
 import argparse
 import sys
 import re
-import os
 import fosslight_util.constant as constant
 from os import PathLike
 from gettext import gettext as _
 from pathlib import Path
 from typing import NamedTuple, Optional, Set
 
-from jinja2 import Environment, FileSystemLoader, PackageLoader, Template
-from jinja2.exceptions import TemplateNotFound
+from jinja2 import Environment, FileSystemLoader, PackageLoader, Template, select_autoescape
 from boolean.boolean import ParseError, Expression
 from license_expression import ExpressionError
 
@@ -105,7 +103,7 @@ def get_loader():
  return loader
 
 
-_ENV = Environment(loader=get_loader(), trim_blocks=True)
+_ENV = Environment(loader=get_loader(), autoescape=select_autoescape([]), trim_blocks=True)
 DEFAULT_TEMPLATE = _ENV.get_template("default_template.jinja2")