From 3dc2393bcdf4eecc61b49eb461c3ead6bc556a19 Mon Sep 17 00:00:00 2001
From: Hugo <hugo.payet@epitech.eu>
Date: Fri, 23 Oct 2026 04:24:33 +0200
Subject: [PATCH 01/13] refactor(templates): parse a template into its markup,
 blocks and includes

_inspect read a template into one flat markup in which every tag was a marker.
Parsing now keeps apart its blocks, with what each holds, its includes and
{{ block.super }}, and the flat markup is rebuilt from them; each file is parsed
once. The verdicts are unchanged: equal to the former ones on 2,238 template
files of Django projects and on 218,421 generated texts.
---
 src/coretrace_python/taint/templates.py | 129 ++++++++++++++++++++----
 1 file changed, 112 insertions(+), 17 deletions(-)

diff --git a/src/coretrace_python/taint/templates.py b/src/coretrace_python/taint/templates.py
index 0607fe5..a85de9b 100644
--- a/src/coretrace_python/taint/templates.py
+++ b/src/coretrace_python/taint/templates.py
@@ -50,7 +50,7 @@
 from dataclasses import dataclass, field
 from pathlib import Path
 from types import MappingProxyType
-from typing import ClassVar, NamedTuple
+from typing import ClassVar, NamedTuple, TypeAlias
 
 from coretrace_python.analysis import Analysis, AnalysisContext
 from coretrace_python.frontend import HIRBuildError, ParseError, build_hir
@@ -271,27 +271,91 @@ def _text(path: Path) -> str | None:
 def _inspect(text: str) -> _Verdict:
     """What the template of ``text`` establishes (``_Verdict``)."""
 
+    parsed = _parse(text)
+    if not parsed.ok:
+        return _REFUSED
+    reading = _read_markup(_flattened(parsed.nodes))
+    return _Verdict(reading.escapes, parsed.extends, parsed.includes, reading.open_end)
+
+
+_Node: TypeAlias = "str | _Block | _Include | _Super"
+
+
+class _Block(NamedTuple):
+    """A ``{% block %}``: its name, what it holds, and whether its ``{% endblock %}``
+    closes it."""
+
+    name: str
+    nodes: tuple[_Node, ...]
+    closed: bool
+
+
+class _Include(NamedTuple):
+    """An ``{% include %}`` of the template ``name``."""
+
+    name: str
+
+
+class _Super(NamedTuple):
+    """``{{ block.super }}``, which renders the parent's definition of its block."""
+
+
+@dataclass(frozen=True)
+class _Parsed:
+    """One template file as its syntax gives it: whether that syntax lets it escape
+    (``ok``: Django's own tags, libraries and escaping filters only); the templates it
+    extends and those it includes; and its ``nodes``, markup in which a variable is
+    ``_OUTPUT``, a ``url`` or ``static`` tag ``_URL`` and any other tag ``_TAG``, with its
+    blocks, includes and ``{{ block.super }}`` kept apart, and its blocks by name."""
+
+    ok: bool
+    extends: frozenset[str] = frozenset()
+    includes: frozenset[str] = frozenset()
+    nodes: tuple[_Node, ...] = ()
+    blocks: Mapping[str, tuple[_Node, ...]] = field(default_factory=dict)
+
+
+_NOT_ESCAPING = _Parsed(ok=False)
+
+
+def _parse(text: str) -> _Parsed:
+    """The template of ``text`` (``_Parsed``)."""
+
     extends: set[str] = set()
     includes: set[str] = set()
-    html: list[str] = []
+    blocks: dict[str, tuple[_Node, ...]] = {}
+    # The blocks open around the position read, each with what it holds so far, under
+    # the nodes the template holds outside them.
+    nodes: list[_Node] = []
+    opened: list[tuple[str, list[_Node]]] = []
     skipping: str | None = None
     position = 0
     text = text.replace(_OUTPUT, "").replace(_TAG, "")
+
+    def held() -> list[_Node]:
+        return opened[-1][1] if opened else nodes
+
+    def close() -> None:
+        name, inside = opened.pop()
+        block = _Block(name, tuple(inside), closed=True)
+        blocks.setdefault(name, block.nodes)
+        held().append(block)
+
     for match in _SYNTAX.finditer(text):
         variable, tag = match.group(1), match.group(2)
         words = tag.split() if tag is not None else []
         if skipping is not None:
             if words[:1] == [skipping]:
                 if skipping == "endverbatim":
-                    html.append(text[position : match.start()])
+                    held().append(text[position : match.start()])
                 skipping, position = None, match.end()
             continue
-        html.append(text[position : match.start()])
+        held().append(text[position : match.start()])
         position = match.end()
         if variable is not None:
             if not _escaping_filters(variable):
-                return _REFUSED
-            html.append(_OUTPUT)
+                return _NOT_ESCAPING
+            held().append(_Super() if variable.strip() == _BLOCK_SUPER else _OUTPUT)
         elif words and words[0] in ("comment", "verbatim"):
             skipping = f"end{words[0]}"
             if words[0] == "verbatim":
@@ -299,24 +363,55 @@ def _inspect(text: str) -> _Verdict:
         elif words:
             name = words[0]
             if name not in _TAGS:
-                return _REFUSED
+                return _NOT_ESCAPING
             if name == "load" and not set(_loaded(words[1:])) <= _LIBRARIES:
-                return _REFUSED
+                return _NOT_ESCAPING
             if name == "autoescape" and words[1:] != ["on"]:
-                return _REFUSED
+                return _NOT_ESCAPING
             if name == "filter" and not _escaping_filters(tag.split(None, 1)[1] if len(words) > 1 else ""):
-                return _REFUSED
+                return _NOT_ESCAPING
             if name in ("extends", "include"):
                 needed = _constant(words[1] if len(words) > 1 else "")
                 if needed is None:
-                    return _REFUSED
-                (extends if name == "extends" else includes).add(needed)
-            html.append(_OUTPUT if name in _PRINTING else _URL if name in ("url", "static") else _TAG)
+                    return _NOT_ESCAPING
+                if name == "extends":
+                    extends.add(needed)
+                    held().append(_TAG)
+                else:
+                    includes.add(needed)
+                    held().append(_Include(needed))
+            elif name == "block" and len(words) > 1:
+                opened.append((words[1], []))
+            elif name == "endblock" and opened:
+                close()
+            else:
+                held().append(_OUTPUT if name in _PRINTING else _URL if name in ("url", "static") else _TAG)
     if skipping is not None:
-        return _REFUSED
-    html.append(text[position:])
-    reading = _read_markup("".join(html))
-    return _Verdict(reading.escapes, frozenset(extends), frozenset(includes), reading.open_end)
+        return _NOT_ESCAPING
+    held().append(text[position:])
+    while opened:
+        name, inside = opened.pop()
+        block = _Block(name, tuple(inside), closed=False)
+        blocks.setdefault(name, block.nodes)
+        held().append(block)
+    return _Parsed(True, frozenset(extends), frozenset(includes), tuple(nodes), MappingProxyType(blocks))
+
+
+def _flattened(nodes: Iterable[_Node]) -> str:
+    """``nodes`` as one markup, each block, include and ``{{ block.super }}`` marked where
+    it stands as the tag or variable it is."""
+
+    parts: list[str] = []
+    for node in nodes:
+        if isinstance(node, str):
+            parts.append(node)
+        elif isinstance(node, _Block):
+            parts.extend((_TAG, _flattened(node.nodes), _TAG if node.closed else ""))
+        elif isinstance(node, _Include):
+            parts.append(_TAG)
+        else:
+            parts.append(_OUTPUT)
+    return "".join(parts)
 
 
 def _loaded(words: list[str]) -> list[str]:

From 373dda159cf40b93d3efbc84293ba313b5ee7409 Mon Sep 17 00:00:00 2001
From: Hugo <hugo.payet@epitech.eu>
Date: Fri, 23 Oct 2026 04:24:33 +0200
Subject: [PATCH 02/13] fix(templates): read the page each template renders,
 its blocks and includes in place

Each template was read on its own: a child's block placed inside its parent's
<script>, or an include placed inside an attribute value, was read as HTML data
in its own file, and a variable there was taken for escaped (#273). Each page is
now also put together as Django renders it, and read once more: the templates it
extends, each block taking the definition of the most derived one and
{{ block.super }} the next one up, and the page of each template it includes, in
place. A template escapes when both readings say so. An include that cannot be
put in place, of a name several files have or on the way to itself, and a parent
several files give leave the page not established for now. A page is bounded at
8 MiB, checked as it grows.
---
 src/coretrace_python/taint/templates.py | 185 +++++++++++++++++++++---
 tests/test_template_page_composition.py | 167 +++++++++++++++++++++
 2 files changed, 334 insertions(+), 18 deletions(-)
 create mode 100644 tests/test_template_page_composition.py

diff --git a/src/coretrace_python/taint/templates.py b/src/coretrace_python/taint/templates.py
index a85de9b..6c1f84e 100644
--- a/src/coretrace_python/taint/templates.py
+++ b/src/coretrace_python/taint/templates.py
@@ -46,7 +46,7 @@
 from __future__ import annotations
 
 import re
-from collections.abc import Container, Iterable, Iterator, Mapping
+from collections.abc import Container, Iterable, Iterator, Mapping, Sequence
 from dataclasses import dataclass, field
 from pathlib import Path
 from types import MappingProxyType
@@ -195,7 +195,9 @@ def escaped_templates(root: Path) -> frozenset[str]:
     as ``render_to_string`` names them (their path below a ``templates`` directory). A
     template including one that ends inside a script or style block, a tag or an end tag
     is not among them: the markup after its include continues that construct. A
-    template extending another renders it, and ends where it ends."""
+    template extending another renders it, and ends where it ends. Each file is read on
+    its own, then the page it renders is put together and read too (``_Composition``):
+    what a block or an include puts inside a construct of another file is read there."""
 
     found: dict[str, list[Path]] = {}
     for path in discover_files(root):
@@ -203,14 +205,16 @@ def escaped_templates(root: Path) -> frozenset[str]:
             return frozenset()
         for name in _names(path.relative_to(root).parts):
             found.setdefault(name, []).append(path)
+    parsed = {path: _parse_file(path) for paths in found.values() for path in paths}
+    composition = _Composition(found, parsed)
     local: dict[str, bool] = {}
     requires: dict[str, set[str]] = {}
     extends: dict[str, set[str]] = {}
     includes: dict[str, set[str]] = {}
     open_ended: set[str] = set()
     for name, paths in found.items():
-        verdicts = [_verdict(path) for path in paths]
-        local[name] = all(verdict.escapes for verdict in verdicts)
+        verdicts = [_verdict(parsed[path]) for path in paths]
+        local[name] = all(verdict.escapes for verdict in verdicts) and all(map(composition.escapes, paths))
         requires[name] = {needed for verdict in verdicts for needed in verdict.extends | verdict.includes}
         extends[name] = {extended for verdict in verdicts for extended in verdict.extends}
         includes[name] = {included for verdict in verdicts for included in verdict.includes}
@@ -251,12 +255,21 @@ class _Verdict(NamedTuple):
 _REFUSED = _Verdict(escapes=False, extends=frozenset(), includes=frozenset(), open_end=False)
 
 
-def _verdict(path: Path) -> _Verdict:
-    """What one template file establishes: a file the engine cannot read is not
-    established to escape, like a template it cannot find."""
+def _verdict(parsed: _Parsed) -> _Verdict:
+    """What one template file establishes, read on its own."""
+
+    if not parsed.ok:
+        return _REFUSED
+    reading = _read_markup(_flattened(parsed.nodes))
+    return _Verdict(reading.escapes, parsed.extends, parsed.includes, reading.open_end)
+
+
+def _parse_file(path: Path) -> _Parsed:
+    """The template file ``path``: one the engine cannot read is not established to
+    escape, like a template it cannot find."""
 
     text = _text(path)
-    return _REFUSED if text is None else _inspect(text)
+    return _NOT_ESCAPING if text is None else _parse(text)
 
 
 def _text(path: Path) -> str | None:
@@ -268,16 +281,6 @@ def _text(path: Path) -> str | None:
         return None
 
 
-def _inspect(text: str) -> _Verdict:
-    """What the template of ``text`` establishes (``_Verdict``)."""
-
-    parsed = _parse(text)
-    if not parsed.ok:
-        return _REFUSED
-    reading = _read_markup(_flattened(parsed.nodes))
-    return _Verdict(reading.escapes, parsed.extends, parsed.includes, reading.open_end)
-
-
 _Node: TypeAlias = "str | _Block | _Include | _Super"
 
 
@@ -414,6 +417,152 @@ def _flattened(nodes: Iterable[_Node]) -> str:
     return "".join(parts)
 
 
+# The size a page put together may reach, in characters, checked as it grows: nested
+# includes can multiply a page beyond any size.
+_PAGE_LIMIT = 8 * 1024 * 1024
+
+
+class _Unrenderable(Exception):
+    """A page Django could not render: a block holding a block of its own name."""
+
+
+class _Composition:
+    """The page each template file renders, put together as Django renders it (#273):
+    its extends chain from the root, each block taking the definition of the most derived
+    template defining it and ``{{ block.super }}`` the next definition up, each include
+    the page of the included template. A child's text outside its blocks is not part of
+    it. A page that cannot be put together in place is not established: a template it
+    needs is missing, refused by its own syntax or given by several files, it includes
+    itself, a block of it holds itself, or it grows beyond ``_PAGE_LIMIT``, which
+    ``too_large`` then lists."""
+
+    def __init__(self, found: Mapping[str, Sequence[Path]], parsed: Mapping[Path, _Parsed]) -> None:
+        self._found = found
+        self._parsed = parsed
+        # Only the pages another one includes are kept: a page is read once, and its
+        # markup is needed again only where it is included.
+        self._included = {
+            paths[0]
+            for p in parsed.values()
+            for name in p.includes
+            if len(paths := found.get(name, ())) == 1
+        }
+        self._pages: dict[Path, str | None] = {}
+        self.too_large: set[Path] = set()
+
+    def escapes(self, path: Path) -> bool:
+        """Whether the page ``path`` renders, put together, is read as escaping."""
+
+        page = self._page(path)
+        return page is not None and _read_markup(page).escapes
+
+    def _page(self, path: Path) -> str | None:
+        if path in self._pages:
+            return self._pages[path]
+        # Depth first over the includes each page renders, without recursion: a page is
+        # put together once the pages it includes are.
+        stack = [path]
+        waiting: set[Path] = set()
+        result: str | None = None
+        while stack:
+            current = stack[-1]
+            if current in self._pages:
+                stack.pop()
+                continue
+            chain = self._chain(current)
+            targets = None if chain is None else self._targets(chain)
+            if targets is None or any(target in waiting for target in targets):
+                page = None
+            elif pending := [target for target in targets if target not in self._pages]:
+                waiting.add(current)
+                stack.extend(pending)
+                continue
+            else:
+                assert chain is not None
+                page = self._render(current, chain)
+            waiting.discard(current)
+            stack.pop()
+            if current == path:
+                result = page
+            if current in self._included or current != path:
+                self._pages[current] = page
+        return result
+
+    def _chain(self, path: Path) -> list[_Parsed] | None:
+        """``path``, then what it extends, up to the root."""
+
+        chain = [self._parsed[path]]
+        seen = {path}
+        while chain[-1].extends:
+            if len(chain[-1].extends) != 1:
+                return None
+            (name,) = chain[-1].extends
+            paths = self._found.get(name, ())
+            if len(paths) != 1 or paths[0] in seen:
+                return None
+            seen.add(paths[0])
+            chain.append(self._parsed[paths[0]])
+        return chain if all(parsed.ok for parsed in chain) else None
+
+    def _targets(self, chain: Sequence[_Parsed]) -> list[Path] | None:
+        """The files the page of ``chain`` includes, or None when one has not exactly one."""
+
+        targets: list[Path] = []
+        try:
+            for node in _rendered(chain):
+                if isinstance(node, _Include):
+                    paths = self._found.get(node.name, ())
+                    if len(paths) != 1:
+                        return None
+                    targets.append(paths[0])
+        except _Unrenderable:
+            return None
+        return targets
+
+    def _render(self, path: Path, chain: Sequence[_Parsed]) -> str | None:
+        parts: list[str] = []
+        size = 0
+        for node in _rendered(chain):
+            if isinstance(node, _Include):
+                included = self._pages[self._found[node.name][0]]
+                if included is None:
+                    return None
+                node = included
+            parts.append(node)
+            size += len(node)
+            if size > _PAGE_LIMIT:
+                self.too_large.add(path)
+                return None
+        return "".join(parts)
+
+
+def _rendered(chain: Sequence[_Parsed]) -> Iterator[str | _Include]:
+    """The markup and the includes of the page ``chain`` renders (a template, then what it
+    extends, up to the root), in order: the root's nodes, each block taking the most
+    derived definition, ``{{ block.super }}`` the next one up."""
+
+    # The nodes being rendered, each run with the level of ``chain`` they come from and
+    # the block they define.
+    stack: list[tuple[Iterator[_Node], int, str | None]] = [(iter(chain[-1].nodes), len(chain) - 1, None)]
+    while stack:
+        nodes, level, block = stack[-1]
+        node = next(nodes, None)
+        if node is None:
+            stack.pop()
+        elif isinstance(node, (str, _Include)):
+            yield node
+        elif isinstance(node, _Block):
+            if any(open_block == node.name for _, _, open_block in stack):
+                raise _Unrenderable(node.name)
+            defining = next((index for index, parsed in enumerate(chain) if node.name in parsed.blocks), None)
+            content = node.nodes if defining is None else chain[defining].blocks[node.name]
+            stack.append((iter(content), level if defining is None else defining, node.name))
+        elif block is not None:
+            parent = next((index for index in range(level + 1, len(chain)) if block in chain[index].blocks), None)
+            if parent is not None:
+                stack.append((iter(chain[parent].blocks[block]), parent, block))
+
+
 def _loaded(words: list[str]) -> list[str]:
     """The libraries ``{% load a b %}`` or ``{% load x y from lib %}`` loads."""
 
diff --git a/tests/test_template_page_composition.py b/tests/test_template_page_composition.py
new file mode 100644
index 0000000..314cd55
--- /dev/null
+++ b/tests/test_template_page_composition.py
@@ -0,0 +1,167 @@
+"""Acceptance tests for issue #273: a page is read as Django puts it together.
+
+A ``{% block %}`` takes the definition the rendered page gives it, which may stand in the
+parent's ``<script>``; an ``{% include %}`` puts the included template's markup where it
+stands, which may be inside an attribute value and end it. Each template file read on
+its own sees neither, so each page is also put together, its blocks and includes in
+place, and read once. Each inspection and analysis runs in a subprocess with a timeout,
+so that one that does not end fails instead of hanging the suite.
+"""
+
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+TIMEOUT = 60
+
+ESCAPED_TEMPLATES = (
+    "import json, sys\n"
+    "from pathlib import Path\n"
+    "from coretrace_python.taint.templates import escaped_templates\n"
+    "print(json.dumps(sorted(escaped_templates(Path(sys.argv[1])))))\n"
+)
+
+VIEW = (
+    "from django.http import HttpRequest, HttpResponse\n"
+    "from django.template.loader import render_to_string\n\n"
+    "def page(request: HttpRequest):\n"
+    "    return HttpResponse(render_to_string('page.html', {'name': request.GET['name']}))\n"
+)
+
+
+def run(command: list[str]) -> subprocess.CompletedProcess[str]:
+    try:
+        return subprocess.run(command, capture_output=True, text=True, check=False, timeout=TIMEOUT)
+    except subprocess.TimeoutExpired:
+        pytest.fail(f"{command[1:3]} did not end within {TIMEOUT} s")
+
+
+def project(tmp_path: Path, templates: dict[str, str]) -> Path:
+    """A project rendering ``page.html`` with the request's ``name``; a template given by
+    its name lies under ``app/templates``, one given by a path under that path."""
+
+    root = tmp_path / "project"
+    (root / "app" / "templates").mkdir(parents=True, exist_ok=True)
+    (root / "app" / "views.py").write_text(VIEW, encoding="utf-8")
+    for name, content in templates.items():
+        path = root / name if "/templates/" in name else root / "app" / "templates" / name
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(content, encoding="utf-8")
+    return root
+
+
+def escaped(tmp_path: Path, templates: dict[str, str]) -> list[str]:
+    completed = run([sys.executable, "-c", ESCAPED_TEMPLATES, str(project(tmp_path, templates))])
+    assert completed.returncode == 0, completed.stderr
+    names: list[str] = json.loads(completed.stdout)
+    return names
+
+
+def xss(tmp_path: Path, templates: dict[str, str]) -> list[tuple[str, int]]:
+    root = project(tmp_path, templates)
+    completed = run([sys.executable, "-m", "coretrace_python", "--check", str(root), "--format", "json"])
+    findings = json.loads(completed.stdout)["findings"]
+    return [(f["location"]["path"], f["location"]["line"]) for f in findings if f["rule_id"] == "xss"]
+
+
+BASE_WITH_SCRIPT_BLOCK = "<html><head><script>{% block js %}{% endblock %}</script></head><body>{% block body %}{% endblock %}</body></html>\n"
+
+
+# The reproductions of #273, rendered with Django 5.1.15: the variable runs as script in
+# F, as an event handler in H, and in H's variant when other/templates comes first.
+@pytest.mark.parametrize(
+    "templates",
+    [
+        {
+            "base.html": "<html><head><script>{% block js %}{% endblock %}</script></head><body></body></html>\n",
+            "page.html": "{% extends 'base.html' %}{% block js %}var name = {{ name }};{% endblock %}\n",
+        },
+        {"page.html": '<a title="{% include "q.html" %}{{ name }}">x</a>\n', "q.html": '" onclick="\n'},
+        {
+            "page.html": '<a title="{% include "q.html" %}{{ name }}">x</a>\n',
+            "q.html": "quote: \n",
+            "other/templates/q.html": '" onclick="\n',
+        },
+    ],
+    ids=["F-block-inside-parent-script", "H-include-inside-attribute-value", "H-include-of-a-name-two-files-have"],
+)
+def test_markup_a_block_or_an_include_puts_inside_a_construct_is_read_there(
+    tmp_path: Path, templates: dict[str, str]
+) -> None:
+    assert xss(tmp_path, templates) == [("app/views.py", 5)]
+
+
+def test_only_the_page_printing_inside_the_parent_script_is_refused(tmp_path: Path) -> None:
+    templates = {
+        "base.html": BASE_WITH_SCRIPT_BLOCK,
+        "page.html": "{% extends 'base.html' %}{% block body %}<p>{{ name }}</p>{% endblock %}\n",
+        "inert.html": "{% extends 'base.html' %}{% block js %}var count = 1;{% endblock %}\n",
+        "script.html": "{% extends 'base.html' %}{% block js %}var name = {{ name }};{% endblock %}\n",
+    }
+
+    assert escaped(tmp_path, templates) == ["base.html", "inert.html", "page.html"]
+
+
+@pytest.mark.parametrize(
+    "templates",
+    [
+        {
+            "base.html": '<body class="{% block bodyclass %}{% endblock %}">{% block content %}{% endblock %}</body>\n',
+            "page.html": "{% extends 'base.html' %}{% block bodyclass %}{{ name }} change-form{% endblock %}\n",
+        },
+        {
+            "base.html": "<script>{% block js %}var count = 1;{% endblock %}</script>\n",
+            "page.html": "{% extends 'base.html' %}{% block js %}{{ block.super }} var total = 2;{% endblock %}\n",
+        },
+        {"page.html": '<a title="{% include "q.html" %}{{ name }}">x</a>\n', "q.html": "prefix \n"},
+        {
+            "base.html": "<p>{% block body %}{% endblock %}</p>\n",
+            "middle.html": "{% extends 'base.html' %}{% block body %}<b>{% block inner %}{% endblock %}</b>{% endblock %}\n",
+            "page.html": "{% extends 'middle.html' %}{% block inner %}{{ name }}{% endblock %}\n",
+        },
+    ],
+    ids=["variable-in-a-quoted-class", "block-super-in-a-script", "include-without-a-quote-in-a-title", "nested-blocks"],
+)
+def test_a_page_whose_parts_stay_escaped_once_put_together_is_established(
+    tmp_path: Path, templates: dict[str, str]
+) -> None:
+    assert escaped(tmp_path, templates) == sorted(templates)
+
+
+@pytest.mark.parametrize(
+    "templates",
+    [
+        {
+            "page.html": "{% include 'self.html' %}",
+            "self.html": '<a title="{% if more %}{% include \'self.html\' %}{% endif %}{{ name }}">x</a>',
+        },
+        {
+            "page.html": "{% include 'a.html' %}",
+            "a.html": "<script>{% if more %}{% include 'b.html' %}{% endif %}</script>",
+            "b.html": "{{ name }}{% include 'a.html' %}",
+        },
+    ],
+    ids=["itself-inside-an-attribute", "through-another-inside-a-script"],
+)
+def test_a_template_including_itself_inside_a_construct_is_not_established(
+    tmp_path: Path, templates: dict[str, str]
+) -> None:
+    # Rendered twice, self.html puts an <a title="…"> inside the title it is in, whose quote
+    # ends that title before the variable; b.html's variable lands inside a.html's script.
+    assert escaped(tmp_path, templates) == []
+
+
+def test_a_page_beyond_eight_mebibytes_is_not_established(tmp_path: Path) -> None:
+    # level{n}.html holds 2 ** n characters once put together: level23.html is 8 MiB,
+    # level24.html beyond, and the page including it is put together no further.
+    templates = {"level0.html": "x"}
+    for level in range(1, 25):
+        templates[f"level{level}.html"] = f"{{% include 'level{level - 1}.html' %}}" * 2
+    templates["page.html"] = "{% include 'level24.html' %}"
+
+    assert escaped(tmp_path, templates) == sorted(f"level{level}.html" for level in range(24))

From fb6b558af3db4b444562d541268c6377ee6db743 Mon Sep 17 00:00:00 2001
From: Hugo <hugo.payet@epitech.eu>
Date: Fri, 23 Oct 2026 04:24:33 +0200
Subject: [PATCH 03/13] fix(templates): accept in HTML data an include of a
 name several files have

Django renders the first file its loaders find, which the engine does not know.
Such an include now inserts a marker standing for each file. The marker is
refused in any attribute, tag, end tag, script or style block and comment, and
right after "<", "</", "<!" or "<!-", where a file could end the construct or
complete one. It is accepted in HTML data when each file escapes and ends in
data, with nothing of it left open. A property test checks that any accepted
text ending in data, put in place of the marker, keeps the page accepted.
---
 src/coretrace_python/taint/templates.py | 123 ++++++++++++++++--------
 tests/test_template_page_composition.py |  83 ++++++++++++++++
 2 files changed, 168 insertions(+), 38 deletions(-)

diff --git a/src/coretrace_python/taint/templates.py b/src/coretrace_python/taint/templates.py
index 6c1f84e..a8f8bdc 100644
--- a/src/coretrace_python/taint/templates.py
+++ b/src/coretrace_python/taint/templates.py
@@ -79,6 +79,9 @@
 TEMPLATETAGS_DIRECTORY = "templatetags"
 
 _OUTPUT, _TAG, _URL = "\x00", "\x01", "/u"
+# Where a page puts the markup of an include it cannot put in place: a name several files
+# have, which Django resolves through loaders the engine does not read.
+_INSERTED = "\x02"
 _SYNTAX = re.compile(r"{{(.*?)}}|{%(.*?)%}|{#.*?#}", re.DOTALL)
 _AUTOESCAPE_OFF = re.compile(r"""["']autoescape["']\s*:\s*False|\bautoescape\s*=\s*False""")
 
@@ -170,6 +173,11 @@
 _COMMENT_END = re.compile(r"--!?>")
 # ``<{{ name }}`` or ``</ {{ name }}``: the variable would name a tag.
 _NAMED_BY_OUTPUT = re.compile(rf"<[/ \t\n]*{_OUTPUT}")
+# What an inserted markup could complete into a tag, an end tag or a comment: ``<``,
+# ``</`` or ``<!`` and ``<!-``; before a marker, or at the end of a text.
+_OPENER = r"<(?:[/ \t\n]*|!-?)"
+_OPENED_BY_INSERTION = re.compile(rf"{_OPENER}{_INSERTED}")
+_ENDING_OPENER = re.compile(rf"{_OPENER}\Z")
 # Django's filter expressions: a constant or a variable, then filters, each with an
 # optional argument, the way ``django.template.base.FilterExpression`` reads them.
 _STRING = r"\"[^\"\\]*(?:\\.[^\"\\]*)*\"|'[^'\\]*(?:\\.[^'\\]*)*'"
@@ -212,9 +220,18 @@ def escaped_templates(root: Path) -> frozenset[str]:
     extends: dict[str, set[str]] = {}
     includes: dict[str, set[str]] = {}
     open_ended: set[str] = set()
+    # The names a page inserts (``_INSERTED``), and those whose every file renders a page
+    # ending in HTML data, as an inserted markup must.
+    inserting: dict[str, set[str]] = {}
+    settled: set[str] = set()
     for name, paths in found.items():
         verdicts = [_verdict(parsed[path]) for path in paths]
-        local[name] = all(verdict.escapes for verdict in verdicts) and all(map(composition.escapes, paths))
+        pages = [composition.page(path) for path in paths]
+        readings = [None if page is None else _read_markup(page.markup) for page in pages]
+        local[name] = all(verdict.escapes for verdict in verdicts) and all(r is not None and r.escapes for r in readings)
+        inserting[name] = {inserted for page in pages if page is not None for inserted in page.inserted}
+        if all(r is not None and r.settled for r in readings):
+            settled.add(name)
         requires[name] = {needed for verdict in verdicts for needed in verdict.extends | verdict.includes}
         extends[name] = {extended for verdict in verdicts for extended in verdict.extends}
         includes[name] = {included for verdict in verdicts for included in verdict.includes}
@@ -222,7 +239,9 @@ def escaped_templates(root: Path) -> frozenset[str]:
             open_ended.add(name)
     while grown := {name for name, extended in extends.items() if extended & open_ended} - open_ended:
         open_ended |= grown
-    escaped = {name for name, safe in local.items() if safe and not includes[name] & open_ended}
+    escaped = {
+        name for name, safe in local.items() if safe and not includes[name] & open_ended and inserting[name] <= settled
+    }
     changed = True
     while changed:
         kept = {name for name in escaped if requires[name] <= escaped}
@@ -333,7 +352,7 @@ def _parse(text: str) -> _Parsed:
     opened: list[tuple[str, list[_Node]]] = []
     skipping: str | None = None
     position = 0
-    text = text.replace(_OUTPUT, "").replace(_TAG, "")
+    text = text.replace(_OUTPUT, "").replace(_TAG, "").replace(_INSERTED, "")
 
     def held() -> list[_Node]:
         return opened[-1][1] if opened else nodes
@@ -426,12 +445,21 @@ class _Unrenderable(Exception):
     """A page Django could not render: a block holding a block of its own name."""
 
 
+class _Page(NamedTuple):
+    """The markup a template renders, and the names of the includes it inserts there
+    (``_INSERTED``), its own and those of the pages it includes."""
+
+    markup: str
+    inserted: frozenset[str] = frozenset()
+
+
 class _Composition:
     """The page each template file renders, put together as Django renders it (#273):
     its extends chain from the root, each block taking the definition of the most derived
     template defining it and ``{{ block.super }}`` the next definition up, each include
-    the page of the included template. A child's text outside its blocks is not part of
-    it. A page that cannot be put together in place is not established: a template it
+    the page of the included template, or, for a name several files have, an inserted
+    markup standing for each (``_INSERTED``). A child's text outside its blocks is not
+    part of it. A page that cannot be put together is not established: a template it
     needs is missing, refused by its own syntax or given by several files, it includes
     itself, a block of it holds itself, or it grows beyond ``_PAGE_LIMIT``, which
     ``too_large`` then lists."""
@@ -447,23 +475,19 @@ def __init__(self, found: Mapping[str, Sequence[Path]], parsed: Mapping[Path, _P
             for name in p.includes
             if len(paths := found.get(name, ())) == 1
         }
-        self._pages: dict[Path, str | None] = {}
+        self._pages: dict[Path, _Page | None] = {}
         self.too_large: set[Path] = set()
 
-    def escapes(self, path: Path) -> bool:
-        """Whether the page ``path`` renders, put together, is read as escaping."""
-
-        page = self._page(path)
-        return page is not None and _read_markup(page).escapes
+    def page(self, path: Path) -> _Page | None:
+        """The page ``path`` renders, put together; None when it cannot be."""
 
-    def _page(self, path: Path) -> str | None:
         if path in self._pages:
             return self._pages[path]
         # Depth first over the includes each page renders, without recursion: a page is
         # put together once the pages it includes are.
         stack = [path]
         waiting: set[Path] = set()
-        result: str | None = None
+        result: _Page | None = None
         while stack:
             current = stack[-1]
             if current in self._pages:
@@ -505,35 +529,44 @@ def _chain(self, path: Path) -> list[_Parsed] | None:
         return chain if all(parsed.ok for parsed in chain) else None
 
     def _targets(self, chain: Sequence[_Parsed]) -> list[Path] | None:
-        """The files the page of ``chain`` includes, or None when one has not exactly one."""
+        """The files the page of ``chain`` includes in place, those of a name one file
+        has; None when a name it includes has none."""
 
         targets: list[Path] = []
         try:
             for node in _rendered(chain):
                 if isinstance(node, _Include):
                     paths = self._found.get(node.name, ())
-                    if len(paths) != 1:
+                    if not paths:
                         return None
-                    targets.append(paths[0])
+                    if len(paths) == 1:
+                        targets.append(paths[0])
         except _Unrenderable:
             return None
         return targets
 
-    def _render(self, path: Path, chain: Sequence[_Parsed]) -> str | None:
+    def _render(self, path: Path, chain: Sequence[_Parsed]) -> _Page | None:
         parts: list[str] = []
+        inserted: set[str] = set()
         size = 0
         for node in _rendered(chain):
             if isinstance(node, _Include):
-                included = self._pages[self._found[node.name][0]]
-                if included is None:
-                    return None
-                node = included
+                paths = self._found[node.name]
+                if len(paths) > 1:
+                    inserted.add(node.name)
+                    node = _INSERTED
+                else:
+                    included = self._pages[paths[0]]
+                    if included is None:
+                        return None
+                    inserted |= included.inserted
+                    node = included.markup
             parts.append(node)
             size += len(node)
             if size > _PAGE_LIMIT:
                 self.too_large.add(path)
                 return None
-        return "".join(parts)
+        return _Page("".join(parts), frozenset(inserted))
 
 
 def _rendered(chain: Sequence[_Parsed]) -> Iterator[str | _Include]:
@@ -580,11 +613,17 @@ def _constant(word: str) -> str | None:
 
 class _Reading(NamedTuple):
     """What one pass over a template's markup establishes: whether every output marker
-    stands where HTML escaping protects it, and whether the text ends inside a script or
-    style block, a tag or an end tag, which the markup after its include continues."""
+    stands where HTML escaping protects it; whether the text ends inside a script or
+    style block, a tag or an end tag, which the markup after its include continues; and
+    whether it ends in HTML data, ``settled``: nothing of it left open, comment included,
+    and no ``<``, ``</``, ``<!`` or ``<!-`` at its end for what follows to complete."""
 
     escapes: bool
     open_end: bool
+    settled: bool = False
+
+
+_NOT_READ = _Reading(escapes=False, open_end=False)
 
 
 def _read_markup(html: str) -> _Reading:
@@ -598,7 +637,12 @@ def _read_markup(html: str) -> _Reading:
     include there may close the comment, a condition around its ``<!--`` leave it out.
     A variable cannot close it, escaped. A comment left open, with no tag after it,
     hides the rest of the text, and hands nothing on: what follows its include stays
-    inside it."""
+    inside it.
+
+    An inserted markup (``_INSERTED``) may hold anything a file of its name holds: it is
+    accepted only in HTML data, never in a comment, a script or style block, a tag or
+    an end tag, nor after what it could complete into one. In data it is as if the
+    markup were there, provided that markup is accepted and ends in data (#273)."""
 
     position = 0
     open_end = False
@@ -614,30 +658,33 @@ def _read_markup(html: str) -> _Reading:
                 close = _COMMENT_END.search(html, start + 2)
                 if close is None:
                     unclosed_from = start
-            first_tag = html.find(_TAG, start + 4, len(html) if close is None else close.start())
+            hidden_to = len(html) if close is None else close.start()
+            first_tag = html.find(_TAG, start + 4, hidden_to)
+            if html.find(_INSERTED, start + 4, hidden_to if first_tag == -1 else first_tag) != -1:
+                return _NOT_READ
             if first_tag != -1:
-                position = first_tag + 1
+                position, open_end = first_tag + 1, False
             elif close is not None:
-                position = close.end()
+                position, open_end = close.end(), False
             else:
-                break
+                return _Reading(escapes=True, open_end=False)
         elif raw := _RAW_TEXT.match(html, start):
-            if _OUTPUT in raw.group(2) or not _attributes_escape(html[start : raw.start(2)]):
-                return _Reading(escapes=False, open_end=False)
+            if _OUTPUT in raw.group(2) or _INSERTED in raw.group(0) or not _attributes_escape(html[start : raw.start(2)]):
+                return _NOT_READ
             position, open_end = raw.end(), not raw.group(3)
         elif tag := _START_TAG.match(html, start):
-            if _OUTPUT in tag.group(1) or not _attributes_escape(tag.group(2)):
-                return _Reading(escapes=False, open_end=False)
+            if _OUTPUT in tag.group(1) or _INSERTED in tag.group(0) or not _attributes_escape(tag.group(2)):
+                return _NOT_READ
             position, open_end = tag.end(), tag.group(3) is None
         elif end := _END_TAG.match(html, start):
-            if _OUTPUT in end.group(0):
-                return _Reading(escapes=False, open_end=False)
+            if _OUTPUT in end.group(0) or _INSERTED in end.group(0):
+                return _NOT_READ
             position, open_end = end.end(), end.group(1) is None
-        elif _NAMED_BY_OUTPUT.match(html, start):
-            return _Reading(escapes=False, open_end=False)
+        elif _NAMED_BY_OUTPUT.match(html, start) or _OPENED_BY_INSERTION.match(html, start):
+            return _NOT_READ
         else:
             position = start + 1
-    return _Reading(escapes=True, open_end=open_end)
+    return _Reading(escapes=True, open_end=open_end, settled=not open_end and not _ENDING_OPENER.search(html))
 
 
 def _attributes_escape(attributes: str) -> bool:
diff --git a/tests/test_template_page_composition.py b/tests/test_template_page_composition.py
index 314cd55..4682cdd 100644
--- a/tests/test_template_page_composition.py
+++ b/tests/test_template_page_composition.py
@@ -10,7 +10,9 @@
 
 from __future__ import annotations
 
+import itertools
 import json
+import random
 import subprocess
 import sys
 from pathlib import Path
@@ -165,3 +167,84 @@ def test_a_page_beyond_eight_mebibytes_is_not_established(tmp_path: Path) -> Non
     templates["page.html"] = "{% include 'level24.html' %}"
 
     assert escaped(tmp_path, templates) == sorted(f"level{level}.html" for level in range(24))
+
+
+# Two files give part.html. Django renders the first its loaders find, which the analyzer
+# does not know: the include stands for each of them.
+def test_an_include_of_a_name_two_files_have_is_established_in_html_data(tmp_path: Path) -> None:
+    templates = {
+        "part.html": "<p>{{ name }}</p>\n",
+        "other/templates/part.html": "<span>x</span>\n",
+        "page.html": "<div>{% include 'part.html' %}</div>\n",
+    }
+
+    assert escaped(tmp_path, templates) == ["page.html", "part.html"]
+
+
+@pytest.mark.parametrize(
+    "page",
+    [
+        '<a title="{% include "part.html" %}">x</a>',
+        "<a {% include 'part.html' %}>x</a>",
+        "<{% include 'part.html' %}>",
+        "</{% include 'part.html' %}>",
+        "<script>{% include 'part.html' %}</script>",
+        "<style>{% include 'part.html' %}</style>",
+        "<!-- {% include 'part.html' %} -->",
+        "<!{% include 'part.html' %}",
+        "<!-{% include 'part.html' %}",
+    ],
+    ids=["attribute-value", "attribute", "tag-name", "end-tag", "script", "style", "comment", "after-bang", "after-bang-dash"],
+)
+def test_an_include_of_a_name_two_files_have_is_refused_outside_html_data(tmp_path: Path, page: str) -> None:
+    # Both files are harmless here: what matters is that either could end the construct.
+    templates = {"part.html": "x\n", "other/templates/part.html": "y\n", "page.html": page}
+
+    assert escaped(tmp_path, templates) == ["part.html"]
+
+
+@pytest.mark.parametrize(
+    "other",
+    ["<script>\n", "<!-- note", "x <", "<!-", "</"],
+    ids=["construct", "comment", "less-than", "comment-opener", "end-tag-opener"],
+)
+def test_an_include_of_a_name_two_files_have_needs_each_to_end_in_html_data(tmp_path: Path, other: str) -> None:
+    templates = {"part.html": "x\n", "other/templates/part.html": other, "page.html": "<div>{% include 'part.html' %}</div>\n"}
+
+    assert escaped(tmp_path, templates) == ["part.html"]
+
+
+# Markup, a variable and a template tag, as the reader sees a page.
+PIECES = ["x", " ", "<p>", "</p>", "<script>", "</script>", '<a title="', '<a onclick="', '"', ">", "<!--", "-->", "<", "</", "<!", "<!-", "-"]
+
+
+def test_text_accepted_in_place_of_the_marker_keeps_the_page_accepted() -> None:
+    """The marker stands for a text the reader accepts and that ends in HTML data. Where
+    the reader accepts the marker, any such text in its place keeps the page accepted,
+    and ending in HTML data: a page made of such texts, nested to any depth, is accepted
+    whatever the texts, which is why one marker may stand for several files. Checked on
+    every text of up to two pieces around the marker, and on random longer ones."""
+
+    from coretrace_python.taint import templates
+
+    pieces = [*PIECES, templates._OUTPUT, templates._TAG]
+    rng = random.Random(273)
+
+    def text(low: int, high: int) -> str:
+        return "".join(rng.choice(pieces) for _ in range(rng.randint(low, high)))
+
+    def accepted(candidate: str) -> bool:
+        reading = templates._read_markup(candidate)
+        return reading.escapes and reading.settled
+
+    short = ["", *pieces, *("".join(pair) for pair in itertools.product(pieces, repeat=2))]
+    contents = [candidate for candidate in short + [text(3, 6) for _ in range(2_000)] if accepted(candidate)]
+    around = [*itertools.product(short, repeat=2), *((text(2, 8), text(2, 8)) for _ in range(20_000))]
+    for prefix, suffix in around:
+        marked = templates._read_markup(prefix + templates._INSERTED + suffix)
+        if not marked.escapes:
+            continue
+        for content in rng.sample(contents, 8):
+            spliced = templates._read_markup(prefix + content + suffix)
+            assert spliced.escapes, (prefix, content, suffix)
+            assert spliced.settled or not marked.settled, (prefix, content, suffix)

From 7173e9306c3029449a575116c10a399882e3bd11 Mon Sep 17 00:00:00 2001
From: Hugo <hugo.payet@epitech.eu>
Date: Fri, 23 Oct 2026 04:24:33 +0200
Subject: [PATCH 04/13] fix(templates): check a page with each file the name of
 its parent may be

A template extending a name several files have is now put together with each of
them, at each level of its chain, and must escape with each. An include of a
template that renders several pages inserts a marker standing for each. One
template renders at most 64 pages, and 16 MiB together.
---
 src/coretrace_python/taint/templates.py | 138 ++++++++++++++----------
 tests/test_template_page_composition.py |  67 ++++++++++++
 2 files changed, 150 insertions(+), 55 deletions(-)

diff --git a/src/coretrace_python/taint/templates.py b/src/coretrace_python/taint/templates.py
index a8f8bdc..2c6d12e 100644
--- a/src/coretrace_python/taint/templates.py
+++ b/src/coretrace_python/taint/templates.py
@@ -227,10 +227,12 @@ def escaped_templates(root: Path) -> frozenset[str]:
     for name, paths in found.items():
         verdicts = [_verdict(parsed[path]) for path in paths]
         pages = [composition.page(path) for path in paths]
-        readings = [None if page is None else _read_markup(page.markup) for page in pages]
-        local[name] = all(verdict.escapes for verdict in verdicts) and all(r is not None and r.escapes for r in readings)
+        readings = [
+            [_read_markup(markup) for markup in page.markups] if page is not None else [_NOT_READ] for page in pages
+        ]
+        local[name] = all(verdict.escapes for verdict in verdicts) and all(r.escapes for rs in readings for r in rs)
         inserting[name] = {inserted for page in pages if page is not None for inserted in page.inserted}
-        if all(r is not None and r.settled for r in readings):
+        if all(r.settled for rs in readings for r in rs):
             settled.add(name)
         requires[name] = {needed for verdict in verdicts for needed in verdict.extends | verdict.includes}
         extends[name] = {extended for verdict in verdicts for extended in verdict.extends}
@@ -439,6 +441,10 @@ def _flattened(nodes: Iterable[_Node]) -> str:
 # The size a page put together may reach, in characters, checked as it grows: nested
 # includes can multiply a page beyond any size.
 _PAGE_LIMIT = 8 * 1024 * 1024
+# The pages one template may render with the files each template it extends may be, and
+# their size together: many small pages never reach the bound of one.
+_VARIANT_LIMIT = 64
+_VARIANTS_SIZE_LIMIT = 16 * 1024 * 1024
 
 
 class _Unrenderable(Exception):
@@ -446,10 +452,11 @@ class _Unrenderable(Exception):
 
 
 class _Page(NamedTuple):
-    """The markup a template renders, and the names of the includes it inserts there
-    (``_INSERTED``), its own and those of the pages it includes."""
+    """The markups a template renders, one for each file each template its extends chain
+    names may be, and the names of the includes it inserts there (``_INSERTED``), its
+    own and those of the pages it includes."""
 
-    markup: str
+    markups: tuple[str, ...]
     inserted: frozenset[str] = frozenset()
 
 
@@ -457,12 +464,14 @@ class _Composition:
     """The page each template file renders, put together as Django renders it (#273):
     its extends chain from the root, each block taking the definition of the most derived
     template defining it and ``{{ block.super }}`` the next definition up, each include
-    the page of the included template, or, for a name several files have, an inserted
-    markup standing for each (``_INSERTED``). A child's text outside its blocks is not
-    part of it. A page that cannot be put together is not established: a template it
-    needs is missing, refused by its own syntax or given by several files, it includes
-    itself, a block of it holds itself, or it grows beyond ``_PAGE_LIMIT``, which
-    ``too_large`` then lists."""
+    the page of the included template, or, for a name several files have or a template
+    rendering several pages, an inserted markup standing for each (``_INSERTED``). A
+    name several files have in the chain gives a page for each, up to ``_VARIANT_LIMIT``
+    and ``_VARIANTS_SIZE_LIMIT`` together, beyond which ``too_many`` lists the template.
+    A child's text outside its blocks is not part of a page. A page that cannot be put
+    together is not established: a template it needs is missing or refused by its own
+    syntax, it includes or extends itself, a block of it holds itself, or it grows
+    beyond ``_PAGE_LIMIT``, which ``too_large`` then lists."""
 
     def __init__(self, found: Mapping[str, Sequence[Path]], parsed: Mapping[Path, _Parsed]) -> None:
         self._found = found
@@ -477,6 +486,7 @@ def __init__(self, found: Mapping[str, Sequence[Path]], parsed: Mapping[Path, _P
         }
         self._pages: dict[Path, _Page | None] = {}
         self.too_large: set[Path] = set()
+        self.too_many: set[Path] = set()
 
     def page(self, path: Path) -> _Page | None:
         """The page ``path`` renders, put together; None when it cannot be."""
@@ -493,8 +503,8 @@ def page(self, path: Path) -> _Page | None:
             if current in self._pages:
                 stack.pop()
                 continue
-            chain = self._chain(current)
-            targets = None if chain is None else self._targets(chain)
+            chains = self._chains(current)
+            targets = None if chains is None else self._targets(chains)
             if targets is None or any(target in waiting for target in targets):
                 page = None
             elif pending := [target for target in targets if target not in self._pages]:
@@ -502,8 +512,8 @@ def page(self, path: Path) -> _Page | None:
                 stack.extend(pending)
                 continue
             else:
-                assert chain is not None
-                page = self._render(current, chain)
+                assert chains is not None
+                page = self._render(current, chains)
             waiting.discard(current)
             stack.pop()
             if current == path:
@@ -512,61 +522,79 @@ def page(self, path: Path) -> _Page | None:
                 self._pages[current] = page
         return result
 
-    def _chain(self, path: Path) -> list[_Parsed] | None:
-        """``path``, then what it extends, up to the root."""
+    def _chains(self, path: Path) -> list[list[_Parsed]] | None:
+        """``path``, then what it extends, up to the root: one chain for each file each
+        name it extends may be."""
 
-        chain = [self._parsed[path]]
-        seen = {path}
-        while chain[-1].extends:
+        chains: list[list[_Parsed]] = []
+        pending: list[tuple[list[_Parsed], frozenset[Path]]] = [([self._parsed[path]], frozenset({path}))]
+        while pending:
+            chain, seen = pending.pop()
+            if not chain[-1].ok:
+                return None
+            if not chain[-1].extends:
+                chains.append(chain)
+                continue
             if len(chain[-1].extends) != 1:
                 return None
             (name,) = chain[-1].extends
             paths = self._found.get(name, ())
-            if len(paths) != 1 or paths[0] in seen:
+            if not paths or seen.intersection(paths):
+                return None
+            pending.extend(([*chain, self._parsed[parent]], seen | {parent}) for parent in paths)
+            if len(chains) + len(pending) > _VARIANT_LIMIT:
+                self.too_many.add(path)
                 return None
-            seen.add(paths[0])
-            chain.append(self._parsed[paths[0]])
-        return chain if all(parsed.ok for parsed in chain) else None
+        return chains
 
-    def _targets(self, chain: Sequence[_Parsed]) -> list[Path] | None:
-        """The files the page of ``chain`` includes in place, those of a name one file
-        has; None when a name it includes has none."""
+    def _targets(self, chains: Iterable[Sequence[_Parsed]]) -> list[Path] | None:
+        """The files the pages of ``chains`` include, those of a name one file has; None
+        when a name they include has none."""
 
         targets: list[Path] = []
         try:
-            for node in _rendered(chain):
-                if isinstance(node, _Include):
-                    paths = self._found.get(node.name, ())
-                    if not paths:
-                        return None
-                    if len(paths) == 1:
-                        targets.append(paths[0])
+            for chain in chains:
+                for node in _rendered(chain):
+                    if isinstance(node, _Include):
+                        paths = self._found.get(node.name, ())
+                        if not paths:
+                            return None
+                        if len(paths) == 1:
+                            targets.append(paths[0])
         except _Unrenderable:
             return None
         return targets
 
-    def _render(self, path: Path, chain: Sequence[_Parsed]) -> _Page | None:
-        parts: list[str] = []
+    def _render(self, path: Path, chains: Iterable[Sequence[_Parsed]]) -> _Page | None:
+        markups: list[str] = []
         inserted: set[str] = set()
-        size = 0
-        for node in _rendered(chain):
-            if isinstance(node, _Include):
-                paths = self._found[node.name]
-                if len(paths) > 1:
-                    inserted.add(node.name)
-                    node = _INSERTED
-                else:
-                    included = self._pages[paths[0]]
-                    if included is None:
+        together = 0
+        for chain in chains:
+            parts: list[str] = []
+            size = 0
+            for node in _rendered(chain):
+                if isinstance(node, _Include):
+                    paths = self._found[node.name]
+                    included = self._pages[paths[0]] if len(paths) == 1 else None
+                    if included is not None and len(included.markups) == 1:
+                        inserted |= included.inserted
+                        node = included.markups[0]
+                    elif len(paths) == 1 and included is None:
                         return None
-                    inserted |= included.inserted
-                    node = included.markup
-            parts.append(node)
-            size += len(node)
-            if size > _PAGE_LIMIT:
-                self.too_large.add(path)
-                return None
-        return _Page("".join(parts), frozenset(inserted))
+                    else:
+                        inserted.add(node.name)
+                        node = _INSERTED
+                parts.append(node)
+                size += len(node)
+                together += len(node)
+                if size > _PAGE_LIMIT:
+                    self.too_large.add(path)
+                    return None
+                if together > _VARIANTS_SIZE_LIMIT:
+                    self.too_many.add(path)
+                    return None
+            markups.append("".join(parts))
+        return _Page(tuple(markups), frozenset(inserted))
 
 
 def _rendered(chain: Sequence[_Parsed]) -> Iterator[str | _Include]:
diff --git a/tests/test_template_page_composition.py b/tests/test_template_page_composition.py
index 4682cdd..d539ade 100644
--- a/tests/test_template_page_composition.py
+++ b/tests/test_template_page_composition.py
@@ -214,6 +214,73 @@ def test_an_include_of_a_name_two_files_have_needs_each_to_end_in_html_data(tmp_
     assert escaped(tmp_path, templates) == ["part.html"]
 
 
+
+# Two files give base.html: the page is put together with each.
+@pytest.mark.parametrize(
+    ("other", "expected"),
+    [
+        ("<div>{% block body %}{% endblock %}</div>\n", ["base.html", "page.html"]),
+        ("<script>{% block body %}{% endblock %}</script>\n", ["base.html"]),
+    ],
+    ids=["each-escapes", "one-runs-the-block-as-script"],
+)
+def test_a_page_extending_a_name_two_files_have_must_escape_with_each(
+    tmp_path: Path, other: str, expected: list[str]
+) -> None:
+    templates = {
+        "base.html": "<p>{% block body %}{% endblock %}</p>\n",
+        "other/templates/base.html": other,
+        "page.html": "{% extends 'base.html' %}{% block body %}{{ name }}{% endblock %}\n",
+    }
+
+    assert escaped(tmp_path, templates) == expected
+
+
+@pytest.mark.parametrize(
+    ("page", "expected"),
+    [
+        ("<div>{% include 'widget.html' %}</div>\n", ["base.html", "page.html", "widget.html"]),
+        ('<a title="{% include \'widget.html\' %}">x</a>\n', ["base.html", "widget.html"]),
+    ],
+    ids=["in-html-data", "in-an-attribute"],
+)
+def test_an_include_of_a_template_with_several_pages_stands_for_each(
+    tmp_path: Path, page: str, expected: list[str]
+) -> None:
+    templates = {
+        "base.html": "<p>{% block body %}{% endblock %}</p>\n",
+        "other/templates/base.html": "<div>{% block body %}{% endblock %}</div>\n",
+        "widget.html": "{% extends 'base.html' %}{% block body %}x{% endblock %}",
+        "page.html": page,
+    }
+
+    assert escaped(tmp_path, templates) == expected
+
+
+def chain_of_names_two_files_have(levels: int, root: str = "x") -> dict[str, str]:
+    # level{n}.html, given by two files, extends level{n - 1}.html: each file of level n
+    # renders 2 ** n pages, one for each file each level below it may be.
+    templates: dict[str, str] = {}
+    for directory in ("app", "other"):
+        templates[f"{directory}/templates/level0.html"] = f"{root}{{% block body %}}{{% endblock %}}"
+        for level in range(1, levels + 1):
+            templates[f"{directory}/templates/level{level}.html"] = (
+                f"{{% extends 'level{level - 1}.html' %}}{{% block body %}}{{{{ name }}}}{{% endblock %}}"
+            )
+    return templates
+
+
+def test_a_template_rendering_more_than_64_pages_is_not_established(tmp_path: Path) -> None:
+    assert escaped(tmp_path, chain_of_names_two_files_have(7)) == [f"level{level}.html" for level in range(7)]
+
+
+def test_pages_of_a_template_beyond_sixteen_mebibytes_together_are_not_established(tmp_path: Path) -> None:
+    # Each of the 64 pages of level6.html holds 300,000 characters: 19.2 million together.
+    templates = chain_of_names_two_files_have(6, root="x" * 300_000)
+
+    assert escaped(tmp_path, templates) == [f"level{level}.html" for level in range(6)]
+
+
 # Markup, a variable and a template tag, as the reader sees a page.
 PIECES = ["x", " ", "<p>", "</p>", "<script>", "</script>", '<a title="', '<a onclick="', '"', ">", "<!--", "-->", "<", "</", "<!", "<!-", "-"]
 

From cde2d05b11e7f2b6da5dbaaa561a3687959666be Mon Sep 17 00:00:00 2001
From: Hugo <hugo.payet@epitech.eu>
Date: Fri, 23 Oct 2026 04:24:33 +0200
Subject: [PATCH 05/13] fix(templates): insert a marker for an include on the
 way to itself

A template including itself, directly or through others, was not put together.
Its recursive include now inserts a marker standing for its own page: accepted
only in HTML data, and only when that page ends in data. Property tests prove it
on generated templates: a text holding such a marker, once accepted, stays
accepted unfolded level after level, and a template established stays
established when its recursion is written out as templates including each
other.
---
 src/coretrace_python/taint/templates.py | 26 +++++----
 tests/test_template_page_composition.py | 74 +++++++++++++++++++++++++
 2 files changed, 90 insertions(+), 10 deletions(-)

diff --git a/src/coretrace_python/taint/templates.py b/src/coretrace_python/taint/templates.py
index 2c6d12e..c9b83f4 100644
--- a/src/coretrace_python/taint/templates.py
+++ b/src/coretrace_python/taint/templates.py
@@ -464,14 +464,16 @@ class _Composition:
     """The page each template file renders, put together as Django renders it (#273):
     its extends chain from the root, each block taking the definition of the most derived
     template defining it and ``{{ block.super }}`` the next definition up, each include
-    the page of the included template, or, for a name several files have or a template
-    rendering several pages, an inserted markup standing for each (``_INSERTED``). A
+    the page of the included template, or, for a name several files have, a template
+    rendering several pages or one on the way to itself, an inserted markup standing for
+    each (``_INSERTED``): a page inserted in HTML data reads as the markup it stands for
+    there, nested to any depth, provided that markup is accepted and ends in data. A
     name several files have in the chain gives a page for each, up to ``_VARIANT_LIMIT``
     and ``_VARIANTS_SIZE_LIMIT`` together, beyond which ``too_many`` lists the template.
     A child's text outside its blocks is not part of a page. A page that cannot be put
     together is not established: a template it needs is missing or refused by its own
-    syntax, it includes or extends itself, a block of it holds itself, or it grows
-    beyond ``_PAGE_LIMIT``, which ``too_large`` then lists."""
+    syntax, it extends itself, a block of it holds itself, or it grows beyond
+    ``_PAGE_LIMIT``, which ``too_large`` then lists."""
 
     def __init__(self, found: Mapping[str, Sequence[Path]], parsed: Mapping[Path, _Parsed]) -> None:
         self._found = found
@@ -505,15 +507,15 @@ def page(self, path: Path) -> _Page | None:
                 continue
             chains = self._chains(current)
             targets = None if chains is None else self._targets(chains)
-            if targets is None or any(target in waiting for target in targets):
+            if targets is None:
                 page = None
-            elif pending := [target for target in targets if target not in self._pages]:
+            elif pending := [target for target in targets if target not in self._pages and target not in waiting]:
                 waiting.add(current)
                 stack.extend(pending)
                 continue
             else:
                 assert chains is not None
-                page = self._render(current, chains)
+                page = self._render(current, chains, waiting)
             waiting.discard(current)
             stack.pop()
             if current == path:
@@ -565,7 +567,10 @@ def _targets(self, chains: Iterable[Sequence[_Parsed]]) -> list[Path] | None:
             return None
         return targets
 
-    def _render(self, path: Path, chains: Iterable[Sequence[_Parsed]]) -> _Page | None:
+    def _render(self, path: Path, chains: Iterable[Sequence[_Parsed]], waiting: Container[Path]) -> _Page | None:
+        """The pages ``chains`` render; an include of a page being put together, on the
+        way to itself, inserted (``_INSERTED``)."""
+
         markups: list[str] = []
         inserted: set[str] = set()
         together = 0
@@ -575,11 +580,12 @@ def _render(self, path: Path, chains: Iterable[Sequence[_Parsed]]) -> _Page | No
             for node in _rendered(chain):
                 if isinstance(node, _Include):
                     paths = self._found[node.name]
-                    included = self._pages[paths[0]] if len(paths) == 1 else None
+                    recursive = len(paths) == 1 and paths[0] in waiting
+                    included = self._pages[paths[0]] if len(paths) == 1 and not recursive else None
                     if included is not None and len(included.markups) == 1:
                         inserted |= included.inserted
                         node = included.markups[0]
-                    elif len(paths) == 1 and included is None:
+                    elif len(paths) == 1 and included is None and not recursive:
                         return None
                     else:
                         inserted.add(node.name)
diff --git a/tests/test_template_page_composition.py b/tests/test_template_page_composition.py
index d539ade..20da33f 100644
--- a/tests/test_template_page_composition.py
+++ b/tests/test_template_page_composition.py
@@ -281,6 +281,23 @@ def test_pages_of_a_template_beyond_sixteen_mebibytes_together_are_not_establish
     assert escaped(tmp_path, templates) == [f"level{level}.html" for level in range(6)]
 
 
+
+def test_a_template_including_itself_in_html_data_is_established(tmp_path: Path) -> None:
+    templates = {
+        "page.html": "{% include 'tree.html' %}",
+        "tree.html": "<li>{{ name }}<ul>{% if more %}{% include 'tree.html' %}{% endif %}</ul></li>",
+    }
+
+    assert escaped(tmp_path, templates) == ["page.html", "tree.html"]
+
+
+def test_a_template_including_itself_must_end_in_html_data(tmp_path: Path) -> None:
+    # Rendered twice, the comment it leaves open runs to the "-->" in the next title, and
+    # the variable after it names a tag.
+    templates = {"self.html": '{% if more %}{% include \'self.html\' %}{% endif %}<a title="--><{{ name }}"><!--'}
+
+    assert escaped(tmp_path, templates) == []
+
 # Markup, a variable and a template tag, as the reader sees a page.
 PIECES = ["x", " ", "<p>", "</p>", "<script>", "</script>", '<a title="', '<a onclick="', '"', ">", "<!--", "-->", "<", "</", "<!", "<!-", "-"]
 
@@ -315,3 +332,60 @@ def accepted(candidate: str) -> bool:
             spliced = templates._read_markup(prefix + content + suffix)
             assert spliced.escapes, (prefix, content, suffix)
             assert spliced.settled or not marked.settled, (prefix, content, suffix)
+
+
+def test_a_text_inserting_itself_is_accepted_only_if_its_unfoldings_are() -> None:
+    """A text holding the marker where it inserts itself, accepted and ending in HTML
+    data, stays accepted unfolded: the marker replaced by the text's own unfolding, level
+    after level, down to the text without it. Checked on every text of up to two pieces
+    around the marker."""
+
+    from coretrace_python.taint import templates
+
+    pieces = [*PIECES, templates._OUTPUT, templates._TAG]
+    short = ["", *pieces, *("".join(pair) for pair in itertools.product(pieces, repeat=2))]
+    for before, after in itertools.product(short, repeat=2):
+        reading = templates._read_markup(before + templates._INSERTED + after)
+        if not (reading.escapes and reading.settled):
+            continue
+        unfolded = before + after
+        for _ in range(3):
+            assert templates._read_markup(unfolded).escapes, (before, after)
+            unfolded = before + unfolded + after
+
+
+# Template pieces around a self-include: unfolded, the include gives way to the template's
+# own text, level after level, until the condition around it, if any, no longer holds.
+TEMPLATE_PIECES = ["x", " ", "{{ name }}", "<", "<!--", "-->", '<a title="', '"', ">", "</a>", "<script>", "</script>", "{% if c %}", "{% endif %}"]
+
+
+def test_a_template_including_itself_is_established_only_if_its_unfoldings_are(tmp_path: Path) -> None:
+    """For generated templates including themselves, established means every unfolding
+    of the recursion, written out as templates including each other down to one that
+    includes nothing, is established too."""
+
+    from coretrace_python.taint.templates import escaped_templates
+
+    rng = random.Random(273)
+    root = tmp_path / "project"
+    directory = root / "app" / "templates"
+    directory.mkdir(parents=True)
+    count, depth = 3_000, 4
+    for index in range(count):
+        before = "".join(rng.choice(TEMPLATE_PIECES) for _ in range(rng.randint(0, 3)))
+        after = "".join(rng.choice(TEMPLATE_PIECES) for _ in range(rng.randint(0, 3)))
+        # Half of them include themselves under a condition, the others without one: a
+        # tag after the include would end a comment its markup leaves open.
+        opening, closing = ("{% if more %}", "{% endif %}") if index % 2 else ("", "")
+        written = {
+            f"t{index}.html": f"{{% include 't{index}.html' %}}",
+            f"t{index}-0.html": "",
+            **{f"t{index}-{level}.html": f"{{% include 't{index}-{level - 1}.html' %}}" for level in range(1, depth)},
+        }
+        for name, included in written.items():
+            (directory / name).write_text(f"{before}{opening}{included}{closing}{after}", encoding="utf-8")
+    established = escaped_templates(root)
+    recursive = [index for index in range(count) if f"t{index}.html" in established]
+    assert recursive
+    for index in recursive:
+        assert all(f"t{index}-{level}.html" in established for level in range(depth)), index

From 1c692ed93d05a791c6af26daeaf8c6384c384172 Mon Sep 17 00:00:00 2001
From: Hugo <hugo.payet@epitech.eu>
Date: Fri, 23 Oct 2026 04:24:33 +0200
Subject: [PATCH 06/13] feat(templates): list the pages that cannot be put
 together among templates not read

A page beyond 8 MiB once put together, and a template with more than 64 pages or
16 MiB in all, are listed in Coverage.unread_templates with the reason.
template_escaping returns them with the names of the templates established to
escape; escaped_templates keeps its interface.
---
 src/coretrace_python/engine.py          |  7 ++--
 src/coretrace_python/taint/__init__.py  |  2 +
 src/coretrace_python/taint/templates.py | 25 +++++++++++-
 tests/test_template_page_composition.py | 51 +++++++++++++++++++++----
 4 files changed, 73 insertions(+), 12 deletions(-)

diff --git a/src/coretrace_python/engine.py b/src/coretrace_python/engine.py
index 63830e7..92bf25a 100644
--- a/src/coretrace_python/engine.py
+++ b/src/coretrace_python/engine.py
@@ -135,10 +135,10 @@
     SecurityModelRegistry,
     TaintAnalysis,
     TaintKind,
-    escaped_templates,
     project_templates,
     registered_routes,
     request_processor,
+    template_escaping,
     unread_renders,
 )
 from coretrace_python.taint.urls import flow_url
@@ -532,7 +532,8 @@ def analyze_project(
     for name in sorted(analysable):
         for symbol, registered in _routes_of(analysable[name]).items():
             routes.setdefault(symbol, registered)
-    escaped = escaped_templates(root)
+    escaping = template_escaping(root)
+    escaped = escaping.escaped
     templates = project_templates(root)
     clearing = models.clearing(escaped)
     template_calls = models.template_calls(
@@ -678,7 +679,7 @@ def analyze_project(
     findings = [_sourced(finding, origins) for finding in findings]
     accepted = tuple(f for f in findings if policy.accepts(f))
     kept, suppressed = partition(apply_policy(policy, findings), _text_of(sources))
-    unread = list(templates.unread)
+    unread = [*templates.unread, *escaping.unread]
     for name in sorted(call_graphs):
         unread.extend(unread_renders(name, call_graphs[name], models, templates.names))
     return ProjectAnalysis(
diff --git a/src/coretrace_python/taint/__init__.py b/src/coretrace_python/taint/__init__.py
index 81bb361..c00f379 100644
--- a/src/coretrace_python/taint/__init__.py
+++ b/src/coretrace_python/taint/__init__.py
@@ -42,6 +42,7 @@
     escaped_templates,
     project_templates,
     request_processor,
+    template_escaping,
     unread_renders,
 )
 
@@ -85,5 +86,6 @@
     "propagate_taint",
     "registered_routes",
     "request_processor",
+    "template_escaping",
     "unread_renders",
 ]
diff --git a/src/coretrace_python/taint/templates.py b/src/coretrace_python/taint/templates.py
index c9b83f4..d4c9dec 100644
--- a/src/coretrace_python/taint/templates.py
+++ b/src/coretrace_python/taint/templates.py
@@ -199,6 +199,21 @@
 
 
 def escaped_templates(root: Path) -> frozenset[str]:
+    """The names of the templates under ``root`` that escape every variable they render
+    (``template_escaping``)."""
+
+    return template_escaping(root).escaped
+
+
+class TemplateEscaping(NamedTuple):
+    """The names of the templates established to escape, and the pages the engine could
+    not put together to establish it, as entries of the templates it could not read."""
+
+    escaped: frozenset[str]
+    unread: tuple[str, ...] = ()
+
+
+def template_escaping(root: Path) -> TemplateEscaping:
     """The names of the templates under ``root`` that escape every variable they render,
     as ``render_to_string`` names them (their path below a ``templates`` directory). A
     template including one that ends inside a script or style block, a tag or an end tag
@@ -210,7 +225,7 @@ def escaped_templates(root: Path) -> frozenset[str]:
     found: dict[str, list[Path]] = {}
     for path in discover_files(root):
         if path.suffix == ".py" and _AUTOESCAPE_OFF.search(_read(path)):
-            return frozenset()
+            return TemplateEscaping(frozenset())
         for name in _names(path.relative_to(root).parts):
             found.setdefault(name, []).append(path)
     parsed = {path: _parse_file(path) for paths in found.values() for path in paths}
@@ -249,7 +264,11 @@ def escaped_templates(root: Path) -> frozenset[str]:
         kept = {name for name in escaped if requires[name] <= escaped}
         changed = kept != escaped
         escaped = kept
-    return frozenset(escaped)
+    unread = [
+        *(f"{path.relative_to(root).as_posix()}, {_TOO_LARGE}" for path in composition.too_large),
+        *(f"{path.relative_to(root).as_posix()}, {_TOO_MANY}" for path in composition.too_many),
+    ]
+    return TemplateEscaping(frozenset(escaped), tuple(sorted(unread)))
 
 
 def _names(parts: tuple[str, ...]) -> Iterator[str]:
@@ -445,6 +464,8 @@ def _flattened(nodes: Iterable[_Node]) -> str:
 # their size together: many small pages never reach the bound of one.
 _VARIANT_LIMIT = 64
 _VARIANTS_SIZE_LIMIT = 16 * 1024 * 1024
+_TOO_LARGE = "beyond 8 MiB once its blocks and includes are put together"
+_TOO_MANY = "more than 64 pages, or 16 MiB in all, with each file the templates it extends may be"
 
 
 class _Unrenderable(Exception):
diff --git a/tests/test_template_page_composition.py b/tests/test_template_page_composition.py
index 20da33f..7b8ed0a 100644
--- a/tests/test_template_page_composition.py
+++ b/tests/test_template_page_composition.py
@@ -64,6 +64,22 @@ def escaped(tmp_path: Path, templates: dict[str, str]) -> list[str]:
     return names
 
 
+UNREAD_TEMPLATES = (
+    "import json, sys\n"
+    "from pathlib import Path\n"
+    "from coretrace_python import engine\n"
+    "analysis = engine.analyze_project(Path(sys.argv[1]), [engine.BUNDLED_PLUGINS])\n"
+    "print(json.dumps(sorted(analysis.coverage.unread_templates)))\n"
+)
+
+
+def unread(tmp_path: Path, templates: dict[str, str]) -> list[str]:
+    completed = run([sys.executable, "-c", UNREAD_TEMPLATES, str(project(tmp_path, templates))])
+    assert completed.returncode == 0, completed.stderr
+    entries: list[str] = json.loads(completed.stdout)
+    return entries
+
+
 def xss(tmp_path: Path, templates: dict[str, str]) -> list[tuple[str, int]]:
     root = project(tmp_path, templates)
     completed = run([sys.executable, "-m", "coretrace_python", "--check", str(root), "--format", "json"])
@@ -158,15 +174,24 @@ def test_a_template_including_itself_inside_a_construct_is_not_established(
     assert escaped(tmp_path, templates) == []
 
 
-def test_a_page_beyond_eight_mebibytes_is_not_established(tmp_path: Path) -> None:
-    # level{n}.html holds 2 ** n characters once put together: level23.html is 8 MiB,
-    # level24.html beyond, and the page including it is put together no further.
-    templates = {"level0.html": "x"}
-    for level in range(1, 25):
+def doubling_includes() -> dict[str, str]:
+    # level{n}.html holds 2 ** n KiB once put together: level13.html is 8 MiB,
+    # level14.html beyond, and the page including it is put together no further.
+    templates = {"level0.html": "x" * 1024}
+    for level in range(1, 15):
         templates[f"level{level}.html"] = f"{{% include 'level{level - 1}.html' %}}" * 2
-    templates["page.html"] = "{% include 'level24.html' %}"
+    templates["page.html"] = "{% include 'level14.html' %}"
+    return templates
+
+
+def test_a_page_beyond_eight_mebibytes_is_not_established(tmp_path: Path) -> None:
+    assert escaped(tmp_path, doubling_includes()) == sorted(f"level{level}.html" for level in range(14))
+
 
-    assert escaped(tmp_path, templates) == sorted(f"level{level}.html" for level in range(24))
+def test_a_page_beyond_eight_mebibytes_is_listed_among_the_templates_not_read(tmp_path: Path) -> None:
+    assert unread(tmp_path, doubling_includes()) == [
+        "app/templates/level14.html, beyond 8 MiB once its blocks and includes are put together"
+    ]
 
 
 # Two files give part.html. Django renders the first its loaders find, which the analyzer
@@ -281,6 +306,18 @@ def test_pages_of_a_template_beyond_sixteen_mebibytes_together_are_not_establish
     assert escaped(tmp_path, templates) == [f"level{level}.html" for level in range(6)]
 
 
+@pytest.mark.parametrize(("levels", "root"), [(7, "x"), (6, "x" * 300_000)], ids=["more-than-64", "beyond-16-mib"])
+def test_a_template_with_too_many_pages_is_listed_among_the_templates_not_read(
+    tmp_path: Path, levels: int, root: str
+) -> None:
+    reason = "more than 64 pages, or 16 MiB in all, with each file the templates it extends may be"
+
+    assert unread(tmp_path, {**chain_of_names_two_files_have(levels, root), "page.html": "x"}) == [
+        f"app/templates/level{levels}.html, {reason}",
+        f"other/templates/level{levels}.html, {reason}",
+    ]
+
+
 
 def test_a_template_including_itself_in_html_data_is_established(tmp_path: Path) -> None:
     templates = {

From 69208db4e3ebc452304badf85c053984c3fdff82 Mon Sep 17 00:00:00 2001
From: Hugo <hugo.payet@epitech.eu>
Date: Fri, 23 Oct 2026 04:24:33 +0200
Subject: [PATCH 07/13] docs: describe how a page is put together to read
 Django templates

The usage guide, the module's docstring and the changelog state how pages are
put together, how a name several files have and a template including itself are
read, and the bounds on a page.
---
 CHANGELOG.md                            |  8 ++++++++
 docs/usage.md                           | 16 ++++++++++++++--
 src/coretrace_python/taint/templates.py |  3 +++
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9a8c9b0..e45930a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,14 @@
   instead of repeating its id (#270), and each result carries its confidence as the
   `confidence` property (#271). A flow reaching its sink inside a project function points at
   that sink as a related location, which the result's message links to (#271).
+- Django templates are also read as each page is put together (#273): a variable a
+  child's `{% block %}` prints inside its parent's `<script>`, an `{% include %}` that ends
+  the attribute value it stands in, or one of a name several files have outside HTML data,
+  is reported as `xss` where it was not. So is a template that includes Django's
+  `django/forms/widgets/attrs.html` inside a tag, which prints attribute names, and a
+  template including itself inside a tag or a script. A page beyond 8 MiB once put
+  together, or a template with more than 64 pages, or 16 MiB in all, through names
+  several files have, is not established and is listed in `Coverage.unread_templates`.
 - Plugin API, additive: `Plugin.rules` maps the rules a plugin reports to their
   `RuleDescription`, optional, so that third-party plugins describe their own rules;
   `Finding.related` lists `RelatedLocation`s (a span and a message). `Report.rules` carries the
diff --git a/docs/usage.md b/docs/usage.md
index ee1bf1b..d418e3e 100644
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -213,8 +213,20 @@ ends there and the browser would never run it. A template including one that end
 such a block, a tag or an end tag is not established either: the markup after the
 include continues it. A template extending another ends where that one ends. A comment
 hides what it holds only up to its first template tag, since an include there may close
-it and a condition around its `<!--` may leave it out. A `{% block %}` or
-`{% include %}` placed inside a parent's `<script>` is not covered yet (#273).
+it and a condition around its `<!--` may leave it out.
+
+Each page is also put together as Django renders it, and read once more (#273): the
+templates it extends, each block taking the definition of the most derived one and
+`{{ block.super }}` the next one up, and each template it includes in place. What a
+child's block prints inside its parent's `<script>`, or what an include puts inside an
+attribute, is read where it lands. A name several files have, which Django resolves
+through loaders the analyzer does not read, counts as each of them: a page extending it
+must escape with each file; an include of it is accepted only in HTML data, never inside
+an attribute, a tag, a `<script>` or `<style>` block or a comment, and only when each
+file ends in HTML data, nothing of it left open. A template including itself is read the
+same way. A page beyond 8 MiB once put together, or a template with more than 64 pages,
+or 16 MiB in all, through the files the templates it extends may be, is not established,
+and is listed among the templates the analyzer could not read.
 
 The analyzer never assumes escaping where it cannot read the template. That covers a
 template file it cannot read, a template named by an expression, a template found
diff --git a/src/coretrace_python/taint/templates.py b/src/coretrace_python/taint/templates.py
index d4c9dec..362dfda 100644
--- a/src/coretrace_python/taint/templates.py
+++ b/src/coretrace_python/taint/templates.py
@@ -14,6 +14,9 @@
   leaves open, which once included runs into the markup that follows;
 - no include of a template that ends inside a ``<script>`` or ``<style>`` block, a tag
   or an end tag, which the markup after the include then continues;
+- none of this either once the page is put together as Django renders it, its blocks
+  and includes in place (``_Composition``): what a block or an include puts inside a
+  construct of another file is read there (#273);
 - no Python file of the project turning autoescaping off.
 
 A comment hides what it holds only up to its first template tag: an include there may

From c1813bb7d1d0591389c78d2b9cf29c41829b56ef Mon Sep 17 00:00:00 2001
From: Hugo <hugo.payet@epitech.eu>
Date: Fri, 23 Oct 2026 05:46:45 +0200
Subject: [PATCH 08/13] fix(templates): keep the alert when block.super is
 printed through a filter or a tag

Only a bare {{ block.super }} was put in place: through a filter, it read as an
escaped variable. Django still prints the parent's markup there, marked safe,
and escape or default keep it as it is. With the parent's block standing between
two quotes of a tag, {{ block.super|escape }}{{ name }} rendered the variable in
an event handler. A use of block.super other than a bare {{ block.super }}, in a
variable or a tag, now leaves the template not established. Every use in the
corpus is bare.
---
 src/coretrace_python/taint/templates.py | 12 +++++++++---
 tests/test_template_page_composition.py | 17 +++++++++++++++++
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/src/coretrace_python/taint/templates.py b/src/coretrace_python/taint/templates.py
index 362dfda..2482336 100644
--- a/src/coretrace_python/taint/templates.py
+++ b/src/coretrace_python/taint/templates.py
@@ -195,6 +195,9 @@
 _LITERALS = frozenset({"True", "False", "None"})
 # The variable a block renders to keep the parent's content, as ``_chain`` reads it.
 _BLOCK_SUPER = "block.super"
+# ``block.super`` anywhere else than a bare ``{{ block.super }}``: Django still gives the
+# parent's markup, marked safe, which a filter such as ``escape`` or ``default`` keeps.
+_BLOCK_SUPER_USE = re.compile(r"\bblock\.super\b")
 
 REQUEST_PROCESSOR = "django.template.context_processors.request"
 _DJANGO_ENGINE = "django.template.backends.django.DjangoTemplates"
@@ -399,16 +402,19 @@ def close() -> None:
         held().append(text[position : match.start()])
         position = match.end()
         if variable is not None:
-            if not _escaping_filters(variable):
+            if variable.strip() == _BLOCK_SUPER:
+                held().append(_Super())
+                continue
+            if not _escaping_filters(variable) or _BLOCK_SUPER_USE.search(variable):
                 return _NOT_ESCAPING
-            held().append(_Super() if variable.strip() == _BLOCK_SUPER else _OUTPUT)
+            held().append(_OUTPUT)
         elif words and words[0] in ("comment", "verbatim"):
             skipping = f"end{words[0]}"
             if words[0] == "verbatim":
                 position = match.end()
         elif words:
             name = words[0]
-            if name not in _TAGS:
+            if name not in _TAGS or _BLOCK_SUPER_USE.search(tag):
                 return _NOT_ESCAPING
             if name == "load" and not set(_loaded(words[1:])) <= _LIBRARIES:
                 return _NOT_ESCAPING
diff --git a/tests/test_template_page_composition.py b/tests/test_template_page_composition.py
index 7b8ed0a..e57a416 100644
--- a/tests/test_template_page_composition.py
+++ b/tests/test_template_page_composition.py
@@ -114,6 +114,23 @@ def test_markup_a_block_or_an_include_puts_inside_a_construct_is_read_there(
     assert xss(tmp_path, templates) == [("app/views.py", 5)]
 
 
+
+# Only a bare {{ block.super }} is put in place. Through a filter or a tag, Django still
+# prints the parent's markup, marked safe, which escape and default keep as it is: what
+# it does there is not established, so the alert stays.
+@pytest.mark.parametrize(
+    "printed",
+    ["{{ block.super|escape }}", '{{ block.super|default:"" }}', "{% with parent=block.super %}{{ parent }}{% endwith %}"],
+    ids=["through-escape", "through-default", "through-with"],
+)
+def test_block_super_printed_otherwise_than_bare_keeps_the_alert(tmp_path: Path, printed: str) -> None:
+    templates = {
+        "base.html": '<a title="{% block attr %}" onclick="{% endblock %}">x</a>\n',
+        "page.html": "{% extends 'base.html' %}{% block attr %}" + printed + "{{ name }}{% endblock %}\n",
+    }
+
+    assert xss(tmp_path, templates) == [("app/views.py", 5)]
+
 def test_only_the_page_printing_inside_the_parent_script_is_refused(tmp_path: Path) -> None:
     templates = {
         "base.html": BASE_WITH_SCRIPT_BLOCK,

From d3b387369f879d4109b1e64e6342c37723c31ffd Mon Sep 17 00:00:00 2001
From: Hugo <hugo.payet@epitech.eu>
Date: Fri, 23 Oct 2026 05:46:45 +0200
Subject: [PATCH 09/13] fix(templates): put each block definition of a page
 together once

The definitions a page renders were walked again at every {{ block.super }},
before any bound applied. A chain whose every block renders its parent twice
doubled the work at each level, though the page stayed empty: 20 levels took
16 s. Each definition is now put together once, then reused, and the includes
are collected visiting each definition once: 60 levels take 0.1 s. The 8 MiB
bound applies to each definition as it grows.
---
 src/coretrace_python/taint/templates.py | 168 ++++++++++++++++--------
 tests/test_template_page_composition.py |  21 +++
 2 files changed, 136 insertions(+), 53 deletions(-)

diff --git a/src/coretrace_python/taint/templates.py b/src/coretrace_python/taint/templates.py
index 2482336..912dbf1 100644
--- a/src/coretrace_python/taint/templates.py
+++ b/src/coretrace_python/taint/templates.py
@@ -581,18 +581,17 @@ def _chains(self, path: Path) -> list[list[_Parsed]] | None:
 
     def _targets(self, chains: Iterable[Sequence[_Parsed]]) -> list[Path] | None:
         """The files the pages of ``chains`` include, those of a name one file has; None
-        when a name they include has none."""
+        when a name they include has none, or a page cannot be rendered."""
 
         targets: list[Path] = []
         try:
             for chain in chains:
-                for node in _rendered(chain):
-                    if isinstance(node, _Include):
-                        paths = self._found.get(node.name, ())
-                        if not paths:
-                            return None
-                        if len(paths) == 1:
-                            targets.append(paths[0])
+                for name in _includes(chain):
+                    paths = self._found.get(name, ())
+                    if not paths:
+                        return None
+                    if len(paths) == 1:
+                        targets.append(paths[0])
         except _Unrenderable:
             return None
         return targets
@@ -605,59 +604,122 @@ def _render(self, path: Path, chains: Iterable[Sequence[_Parsed]], waiting: Cont
         inserted: set[str] = set()
         together = 0
         for chain in chains:
-            parts: list[str] = []
-            size = 0
-            for node in _rendered(chain):
-                if isinstance(node, _Include):
-                    paths = self._found[node.name]
-                    recursive = len(paths) == 1 and paths[0] in waiting
-                    included = self._pages[paths[0]] if len(paths) == 1 and not recursive else None
-                    if included is not None and len(included.markups) == 1:
-                        inserted |= included.inserted
-                        node = included.markups[0]
-                    elif len(paths) == 1 and included is None and not recursive:
-                        return None
-                    else:
-                        inserted.add(node.name)
-                        node = _INSERTED
-                parts.append(node)
-                size += len(node)
-                together += len(node)
-                if size > _PAGE_LIMIT:
-                    self.too_large.add(path)
-                    return None
-                if together > _VARIANTS_SIZE_LIMIT:
-                    self.too_many.add(path)
-                    return None
-            markups.append("".join(parts))
+            markup = self._markup(path, chain, waiting, inserted)
+            if markup is None:
+                return None
+            together += len(markup)
+            if together > _VARIANTS_SIZE_LIMIT:
+                self.too_many.add(path)
+                return None
+            markups.append(markup)
         return _Page(tuple(markups), frozenset(inserted))
 
+    def _markup(self, path: Path, chain: Sequence[_Parsed], waiting: Container[Path], inserted: set[str]) -> str | None:
+        """The page of ``chain``, each definition put together once however many times
+        the page renders it, and each bounded as it grows: a block rendering its parent
+        twice at every level doubles the page, not the work."""
+
+        made: dict[_Key, str] = {}
+        root = _root(chain)
+        # The definitions being put together, each with what it renders so far and its size.
+        stack: list[tuple[_Key, Iterator[_Node], list[str], list[int]]] = [(root, iter(_definition(chain, root)), [], [0])]
+        while stack:
+            key, nodes, parts, size = stack[-1]
+            node = next(nodes, None)
+            if node is None:
+                stack.pop()
+                made[key] = piece = "".join(parts)
+                if not stack:
+                    return piece
+            elif isinstance(node, str):
+                piece = node
+            elif isinstance(node, _Include):
+                included = self._include_markup(node.name, waiting, inserted)
+                if included is None:
+                    return None
+                piece = included
+            else:
+                inner = _resolved(chain, key, node)
+                if inner is None:
+                    continue
+                if inner not in made:
+                    stack.append((inner, iter(_definition(chain, inner)), [], [0]))
+                    continue
+                piece = made[inner]
+            _, _, parts, size = stack[-1]
+            parts.append(piece)
+            size[0] += len(piece)
+            if size[0] > _PAGE_LIMIT:
+                self.too_large.add(path)
+                return None
+        return None
+
+    def _include_markup(self, name: str, waiting: Container[Path], inserted: set[str]) -> str | None:
+        """What an include of ``name`` puts in a page: the page of its one file, or an
+        inserted markup; None when that page cannot be put together."""
+
+        paths = self._found[name]
+        recursive = len(paths) == 1 and paths[0] in waiting
+        included = self._pages[paths[0]] if len(paths) == 1 and not recursive else None
+        if included is not None and len(included.markups) == 1:
+            inserted |= included.inserted
+            return included.markups[0]
+        if len(paths) == 1 and included is None and not recursive:
+            return None
+        inserted.add(name)
+        return _INSERTED
+
+
+# A definition a page renders: a block's, in the template of ``chain`` at that level, or,
+# with no name, the root's nodes outside its blocks.
+_Key = tuple[str | None, int]
+
+
+def _root(chain: Sequence[_Parsed]) -> _Key:
+    return None, len(chain) - 1
+
+
+def _definition(chain: Sequence[_Parsed], key: _Key) -> tuple[_Node, ...]:
+    name, level = key
+    return chain[level].nodes if name is None else chain[level].blocks[name]
+
 
-def _rendered(chain: Sequence[_Parsed]) -> Iterator[str | _Include]:
-    """The markup and the includes of the page ``chain`` renders (a template, then what it
-    extends, up to the root), in order: the root's nodes, each block taking the most
-    derived definition, ``{{ block.super }}`` the next one up."""
+def _resolved(chain: Sequence[_Parsed], key: _Key, node: _Block | _Super) -> _Key | None:
+    """The definition ``node`` renders, standing in the definition ``key``: for a block,
+    that of the most derived template defining it; for ``{{ block.super }}``, the next
+    one up, if any."""
 
-    # The nodes being rendered, each run with the level of ``chain`` they come from and
-    # the block they define.
-    stack: list[tuple[Iterator[_Node], int, str | None]] = [(iter(chain[-1].nodes), len(chain) - 1, None)]
+    name, level = key
+    if isinstance(node, _Block):
+        return node.name, next(index for index, parsed in enumerate(chain) if node.name in parsed.blocks)
+    if name is None:
+        return None
+    parent = next((index for index in range(level + 1, len(chain)) if name in chain[index].blocks), None)
+    return None if parent is None else (name, parent)
+
+
+def _includes(chain: Sequence[_Parsed]) -> list[str]:
+    """The names the page of ``chain`` includes, each definition it renders visited once
+    however many times it is rendered: a block holding itself, which Django cannot
+    render, raises ``_Unrenderable``."""
+
+    found: list[str] = []
+    visited = {_root(chain)}
+    stack: list[tuple[_Key, Iterator[_Node]]] = [(_root(chain), iter(_definition(chain, _root(chain))))]
     while stack:
-        nodes, level, block = stack[-1]
+        key, nodes = stack[-1]
         node = next(nodes, None)
         if node is None:
             stack.pop()
-        elif isinstance(node, (str, _Include)):
-            yield node
-        elif isinstance(node, _Block):
-            if any(open_block == node.name for _, _, open_block in stack):
-                raise _Unrenderable(node.name)
-            defining = next((index for index, parsed in enumerate(chain) if node.name in parsed.blocks), None)
-            content = node.nodes if defining is None else chain[defining].blocks[node.name]
-            stack.append((iter(content), level if defining is None else defining, node.name))
-        elif block is not None:
-            parent = next((index for index in range(level + 1, len(chain)) if block in chain[index].blocks), None)
-            if parent is not None:
-                stack.append((iter(chain[parent].blocks[block]), parent, block))
+        elif isinstance(node, _Include):
+            found.append(node.name)
+        elif not isinstance(node, str) and (inner := _resolved(chain, key, node)) is not None:
+            if any(inner == open_key for open_key, _ in stack):
+                raise _Unrenderable(inner[0])
+            if inner not in visited:
+                visited.add(inner)
+                stack.append((inner, iter(_definition(chain, inner))))
+    return found
 
 
 def _loaded(words: list[str]) -> list[str]:
diff --git a/tests/test_template_page_composition.py b/tests/test_template_page_composition.py
index e57a416..d42035d 100644
--- a/tests/test_template_page_composition.py
+++ b/tests/test_template_page_composition.py
@@ -205,6 +205,27 @@ def test_a_page_beyond_eight_mebibytes_is_not_established(tmp_path: Path) -> Non
     assert escaped(tmp_path, doubling_includes()) == sorted(f"level{level}.html" for level in range(14))
 
 
+
+def chain_doubling_block_super(levels: int, root: str) -> dict[str, str]:
+    # level{n}.html renders its parent's block twice: its page holds the root's block
+    # content 2 ** n times.
+    templates = {"level0.html": f"{{% block body %}}{root}{{% endblock %}}"}
+    for level in range(1, levels + 1):
+        templates[f"level{level}.html"] = (
+            f"{{% extends 'level{level - 1}.html' %}}{{% block body %}}{{{{ block.super }}}}{{{{ block.super }}}}{{% endblock %}}"
+        )
+    return templates
+
+
+def test_a_block_rendering_its_parent_twice_at_every_level_is_put_together_once(tmp_path: Path) -> None:
+    # The page stays empty however deep the chain: each definition is put together once.
+    assert escaped(tmp_path, chain_doubling_block_super(30, "")) == sorted(f"level{level}.html" for level in range(31))
+
+
+def test_a_block_rendering_its_parent_twice_stops_at_eight_mebibytes(tmp_path: Path) -> None:
+    # level13.html holds 8 MiB of the root's content, level14.html beyond.
+    assert escaped(tmp_path, chain_doubling_block_super(16, "x" * 1024)) == sorted(f"level{level}.html" for level in range(14))
+
 def test_a_page_beyond_eight_mebibytes_is_listed_among_the_templates_not_read(tmp_path: Path) -> None:
     assert unread(tmp_path, doubling_includes()) == [
         "app/templates/level14.html, beyond 8 MiB once its blocks and includes are put together"

From 3136adcf0202ffbc13d679081fb8feec9613cad3 Mon Sep 17 00:00:00 2001
From: Hugo <hugo.payet@epitech.eu>
Date: Fri, 23 Oct 2026 05:46:45 +0200
Subject: [PATCH 10/13] fix(templates): leave out the files already in the
 chain when a template extends its own name

Django's loaders skip the files an extends chain already holds: a page.html
extending 'page.html' extends another file of that name. Such a chain was taken
for a cycle, and the page reported as xss, though Django keeps the data escaped.
The files already in the chain are now left out, and each remaining one is
checked; with none left, the page is not established, as Django raises an
error.
---
 src/coretrace_python/taint/templates.py |  9 +++++----
 tests/test_template_page_composition.py | 27 +++++++++++++++++++++++++
 2 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/src/coretrace_python/taint/templates.py b/src/coretrace_python/taint/templates.py
index 912dbf1..6d31e05 100644
--- a/src/coretrace_python/taint/templates.py
+++ b/src/coretrace_python/taint/templates.py
@@ -556,7 +556,8 @@ def page(self, path: Path) -> _Page | None:
 
     def _chains(self, path: Path) -> list[list[_Parsed]] | None:
         """``path``, then what it extends, up to the root: one chain for each file each
-        name it extends may be."""
+        name it extends may be. As Django's loaders do, the files already in the chain
+        are left out: a template extending its own name extends another file of it."""
 
         chains: list[list[_Parsed]] = []
         pending: list[tuple[list[_Parsed], frozenset[Path]]] = [([self._parsed[path]], frozenset({path}))]
@@ -570,10 +571,10 @@ def _chains(self, path: Path) -> list[list[_Parsed]] | None:
             if len(chain[-1].extends) != 1:
                 return None
             (name,) = chain[-1].extends
-            paths = self._found.get(name, ())
-            if not paths or seen.intersection(paths):
+            parents = [parent for parent in self._found.get(name, ()) if parent not in seen]
+            if not parents:
                 return None
-            pending.extend(([*chain, self._parsed[parent]], seen | {parent}) for parent in paths)
+            pending.extend(([*chain, self._parsed[parent]], seen | {parent}) for parent in parents)
             if len(chains) + len(pending) > _VARIANT_LIMIT:
                 self.too_many.add(path)
                 return None
diff --git a/tests/test_template_page_composition.py b/tests/test_template_page_composition.py
index d42035d..b4cda25 100644
--- a/tests/test_template_page_composition.py
+++ b/tests/test_template_page_composition.py
@@ -299,6 +299,33 @@ def test_a_page_extending_a_name_two_files_have_must_escape_with_each(
     assert escaped(tmp_path, templates) == expected
 
 
+
+# A template extending its own name: Django leaves out the files already in the chain and
+# takes one of the others, rendering the user's data escaped here.
+@pytest.mark.parametrize(
+    ("other", "expected_xss"),
+    [
+        ("<p>{% block body %}{% endblock %}</p>\n", []),
+        ("<script>{% block body %}{% endblock %}</script>\n", [("app/views.py", 5)]),
+    ],
+    ids=["the-other-file-escapes", "the-other-file-runs-the-block-as-script"],
+)
+def test_a_template_extending_its_own_name_extends_another_file_of_it(
+    tmp_path: Path, other: str, expected_xss: list[tuple[str, int]]
+) -> None:
+    templates = {
+        "page.html": "{% extends 'page.html' %}{% block body %}<b>{{ name }}</b>{% endblock %}\n",
+        "other/templates/page.html": other,
+    }
+
+    assert xss(tmp_path, templates) == expected_xss
+
+
+def test_a_template_extending_its_own_name_with_no_other_file_is_not_established(tmp_path: Path) -> None:
+    templates = {"page.html": "{% extends 'page.html' %}{% block body %}<b>{{ name }}</b>{% endblock %}\n"}
+
+    assert escaped(tmp_path, templates) == []
+
 @pytest.mark.parametrize(
     ("page", "expected"),
     [

From c88a700174e2ae2020a4b226176f626f99969d0d Mon Sep 17 00:00:00 2001
From: Hugo <hugo.payet@epitech.eu>
Date: Fri, 23 Oct 2026 05:46:45 +0200
Subject: [PATCH 11/13] docs: state how block.super and a template extending
 its own name are read

---
 CHANGELOG.md  |  3 ++-
 docs/usage.md | 26 +++++++++++++++-----------
 2 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e45930a..24d050b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,7 +23,8 @@
 - Django templates are also read as each page is put together (#273): a variable a
   child's `{% block %}` prints inside its parent's `<script>`, an `{% include %}` that ends
   the attribute value it stands in, or one of a name several files have outside HTML data,
-  is reported as `xss` where it was not. So is a template that includes Django's
+  is reported as `xss` where it was not, as is `{{ block.super }}` printed through a
+  filter or a tag. So is a template that includes Django's
   `django/forms/widgets/attrs.html` inside a tag, which prints attribute names, and a
   template including itself inside a tag or a script. A page beyond 8 MiB once put
   together, or a template with more than 64 pages, or 16 MiB in all, through names
diff --git a/docs/usage.md b/docs/usage.md
index d418e3e..22cdab8 100644
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -216,17 +216,21 @@ hides what it holds only up to its first template tag, since an include there ma
 it and a condition around its `<!--` may leave it out.
 
 Each page is also put together as Django renders it, and read once more (#273): the
-templates it extends, each block taking the definition of the most derived one and
-`{{ block.super }}` the next one up, and each template it includes in place. What a
-child's block prints inside its parent's `<script>`, or what an include puts inside an
-attribute, is read where it lands. A name several files have, which Django resolves
-through loaders the analyzer does not read, counts as each of them: a page extending it
-must escape with each file; an include of it is accepted only in HTML data, never inside
-an attribute, a tag, a `<script>` or `<style>` block or a comment, and only when each
-file ends in HTML data, nothing of it left open. A template including itself is read the
-same way. A page beyond 8 MiB once put together, or a template with more than 64 pages,
-or 16 MiB in all, through the files the templates it extends may be, is not established,
-and is listed among the templates the analyzer could not read.
+templates it extends, each block taking the definition of the most derived one and `{{
+block.super }}` the next one up, and each template it includes in place. What a child's
+block prints inside its parent's `<script>`, or what an include puts inside an
+attribute, is read where it lands. `{{ block.super }}` is put in place only bare:
+through a filter or a tag, Django still prints the parent's markup, marked safe, and the
+template is not established. A name several files have, which Django resolves through
+loaders the analyzer does not read, counts as each of them: a page extending it must
+escape with each file, except those already in its chain, which Django leaves out, so
+that a template extending its own name extends another file of it; an include of it is
+accepted only in HTML data, never inside an attribute, a tag, a `<script>` or `<style>`
+block or a comment, and only when each file ends in HTML data, nothing of it left open.
+A template including itself is read the same way. A page beyond 8 MiB once put together,
+or a template with more than 64 pages, or 16 MiB in all, through the files the templates
+it extends may be, is not established, and is listed among the templates the analyzer
+could not read.
 
 The analyzer never assumes escaping where it cannot read the template. That covers a
 template file it cannot read, a template named by an expression, a template found

From 5a878be81cc43c054404e4a3c1b9806c0fc6a31e Mon Sep 17 00:00:00 2001
From: Hugo <hugo.payet@epitech.eu>
Date: Fri, 23 Oct 2026 06:45:33 +0200
Subject: [PATCH 12/13] fix(templates): keep the alert wherever the variable
 block is named but in a bare block.super

The check looked for block.super itself, and an alias of the block slipped past
it. With the parent's block standing between two quotes of a tag,
{% with parent=block %}{{ parent.super }}{{ name }}{% endwith %} rendered the
variable in an event handler, through |escape too. A template naming the
variable block anywhere but in a bare {{ block.super }}, in a variable or a tag,
outside string literals and the names of block tags, is now not established. A
bare {{ block.super }} in an included template, which Django renders as nothing
there, keeps its reading.
---
 src/coretrace_python/taint/templates.py | 19 +++++++++++-----
 tests/test_template_page_composition.py | 29 ++++++++++++++++++++-----
 2 files changed, 37 insertions(+), 11 deletions(-)

diff --git a/src/coretrace_python/taint/templates.py b/src/coretrace_python/taint/templates.py
index 6d31e05..e18312b 100644
--- a/src/coretrace_python/taint/templates.py
+++ b/src/coretrace_python/taint/templates.py
@@ -195,9 +195,12 @@
 _LITERALS = frozenset({"True", "False", "None"})
 # The variable a block renders to keep the parent's content, as ``_chain`` reads it.
 _BLOCK_SUPER = "block.super"
-# ``block.super`` anywhere else than a bare ``{{ block.super }}``: Django still gives the
-# parent's markup, marked safe, which a filter such as ``escape`` or ``default`` keeps.
-_BLOCK_SUPER_USE = re.compile(r"\bblock\.super\b")
+# The variable ``block``, which Django binds inside a block to the block itself: named
+# anywhere else than in a bare ``{{ block.super }}``, it may give the parent's markup,
+# marked safe, through a filter such as ``escape`` or ``default`` or through an alias
+# (``{% with parent=block %}{{ parent.super }}``). A name such as Handlebars'
+# ``@partial-block`` is not it.
+_BLOCK_VARIABLE = re.compile(r"(?<![\w.@-])block(?![\w-])")
 
 REQUEST_PROCESSOR = "django.template.context_processors.request"
 _DJANGO_ENGINE = "django.template.backends.django.DjangoTemplates"
@@ -405,7 +408,7 @@ def close() -> None:
             if variable.strip() == _BLOCK_SUPER:
                 held().append(_Super())
                 continue
-            if not _escaping_filters(variable) or _BLOCK_SUPER_USE.search(variable):
+            if not _escaping_filters(variable) or _names_block(variable):
                 return _NOT_ESCAPING
             held().append(_OUTPUT)
         elif words and words[0] in ("comment", "verbatim"):
@@ -414,7 +417,7 @@ def close() -> None:
                 position = match.end()
         elif words:
             name = words[0]
-            if name not in _TAGS or _BLOCK_SUPER_USE.search(tag):
+            if name not in _TAGS or name not in ("block", "endblock") and _names_block(tag):
                 return _NOT_ESCAPING
             if name == "load" and not set(_loaded(words[1:])) <= _LIBRARIES:
                 return _NOT_ESCAPING
@@ -449,6 +452,12 @@ def close() -> None:
     return _Parsed(True, frozenset(extends), frozenset(includes), tuple(nodes), MappingProxyType(blocks))
 
 
+def _names_block(expression: str) -> bool:
+    """Whether ``expression`` names the variable ``block`` outside its string literals."""
+
+    return _BLOCK_VARIABLE.search(re.sub(_STRING, "", expression)) is not None
+
+
 def _flattened(nodes: Iterable[_Node]) -> str:
     """``nodes`` as one markup, each block, include and ``{{ block.super }}`` marked where
     it stands as the tag or variable it is."""
diff --git a/tests/test_template_page_composition.py b/tests/test_template_page_composition.py
index b4cda25..3588de3 100644
--- a/tests/test_template_page_composition.py
+++ b/tests/test_template_page_composition.py
@@ -115,15 +115,21 @@ def test_markup_a_block_or_an_include_puts_inside_a_construct_is_read_there(
 
 
 
-# Only a bare {{ block.super }} is put in place. Through a filter or a tag, Django still
-# prints the parent's markup, marked safe, which escape and default keep as it is: what
-# it does there is not established, so the alert stays.
+# Only a bare {{ block.super }} is put in place. Through a filter, a tag or an alias of the
+# block, Django still prints the parent's markup, marked safe, which escape and default
+# keep as it is: what it does there is not established, so the alert stays.
 @pytest.mark.parametrize(
     "printed",
-    ["{{ block.super|escape }}", '{{ block.super|default:"" }}', "{% with parent=block.super %}{{ parent }}{% endwith %}"],
-    ids=["through-escape", "through-default", "through-with"],
+    [
+        "{{ block.super|escape }}",
+        '{{ block.super|default:"" }}',
+        "{% with parent=block.super %}{{ parent }}{% endwith %}",
+        "{% with parent=block %}{{ parent.super }}{% endwith %}",
+        "{% with parent=block %}{{ parent.super|escape }}{% endwith %}",
+    ],
+    ids=["through-escape", "through-default", "through-with", "alias-of-the-block", "alias-through-escape"],
 )
-def test_block_super_printed_otherwise_than_bare_keeps_the_alert(tmp_path: Path, printed: str) -> None:
+def test_the_block_used_otherwise_than_in_a_bare_block_super_keeps_the_alert(tmp_path: Path, printed: str) -> None:
     templates = {
         "base.html": '<a title="{% block attr %}" onclick="{% endblock %}">x</a>\n',
         "page.html": "{% extends 'base.html' %}{% block attr %}" + printed + "{{ name }}{% endblock %}\n",
@@ -131,6 +137,17 @@ def test_block_super_printed_otherwise_than_bare_keeps_the_alert(tmp_path: Path,
 
     assert xss(tmp_path, templates) == [("app/views.py", 5)]
 
+
+def test_block_super_in_an_included_template_renders_nothing_there(tmp_path: Path) -> None:
+    # Django renders an include apart from the blocks around it: block.super gives "" there.
+    templates = {
+        "base.html": '<a title="{% block attr %}" onclick="{% endblock %}">x</a>\n',
+        "parent.html": "{{ block.super }}",
+        "page.html": "{% extends 'base.html' %}{% block attr %}{% include 'parent.html' %}{{ name }}{% endblock %}\n",
+    }
+
+    assert escaped(tmp_path, templates) == ["base.html", "page.html", "parent.html"]
+
 def test_only_the_page_printing_inside_the_parent_script_is_refused(tmp_path: Path) -> None:
     templates = {
         "base.html": BASE_WITH_SCRIPT_BLOCK,

From 9e954b2cc479ff5014449d6c9e7699412d3be03a Mon Sep 17 00:00:00 2001
From: Hugo <hugo.payet@epitech.eu>
Date: Fri, 23 Oct 2026 06:45:33 +0200
Subject: [PATCH 13/13] docs: state that the variable block is read only in a
 bare block.super

---
 CHANGELOG.md  |  4 ++--
 docs/usage.md | 25 +++++++++++++------------
 2 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 24d050b..cc8376c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,8 +23,8 @@
 - Django templates are also read as each page is put together (#273): a variable a
   child's `{% block %}` prints inside its parent's `<script>`, an `{% include %}` that ends
   the attribute value it stands in, or one of a name several files have outside HTML data,
-  is reported as `xss` where it was not, as is `{{ block.super }}` printed through a
-  filter or a tag. So is a template that includes Django's
+  is reported as `xss` where it was not, as is the variable `block` named anywhere but in
+  a bare `{{ block.super }}`. So is a template that includes Django's
   `django/forms/widgets/attrs.html` inside a tag, which prints attribute names, and a
   template including itself inside a tag or a script. A page beyond 8 MiB once put
   together, or a template with more than 64 pages, or 16 MiB in all, through names
diff --git a/docs/usage.md b/docs/usage.md
index 22cdab8..ae8281d 100644
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -219,18 +219,19 @@ Each page is also put together as Django renders it, and read once more (#273):
 templates it extends, each block taking the definition of the most derived one and `{{
 block.super }}` the next one up, and each template it includes in place. What a child's
 block prints inside its parent's `<script>`, or what an include puts inside an
-attribute, is read where it lands. `{{ block.super }}` is put in place only bare:
-through a filter or a tag, Django still prints the parent's markup, marked safe, and the
-template is not established. A name several files have, which Django resolves through
-loaders the analyzer does not read, counts as each of them: a page extending it must
-escape with each file, except those already in its chain, which Django leaves out, so
-that a template extending its own name extends another file of it; an include of it is
-accepted only in HTML data, never inside an attribute, a tag, a `<script>` or `<style>`
-block or a comment, and only when each file ends in HTML data, nothing of it left open.
-A template including itself is read the same way. A page beyond 8 MiB once put together,
-or a template with more than 64 pages, or 16 MiB in all, through the files the templates
-it extends may be, is not established, and is listed among the templates the analyzer
-could not read.
+attribute, is read where it lands. `{{ block.super }}` is put in place only bare: the
+variable `block` named anywhere else, through a filter, a tag or an alias (`{% with
+parent=block %}{{ parent.super }}`), may still print the parent's markup, marked safe,
+and the template is not established. A name several files have, which Django resolves
+through loaders the analyzer does not read, counts as each of them: a page extending it
+must escape with each file, except those already in its chain, which Django leaves out,
+so that a template extending its own name extends another file of it; an include of it
+is accepted only in HTML data, never inside an attribute, a tag, a `<script>` or
+`<style>` block or a comment, and only when each file ends in HTML data, nothing of it
+left open. A template including itself is read the same way. A page beyond 8 MiB once
+put together, or a template with more than 64 pages, or 16 MiB in all, through the files
+the templates it extends may be, is not established, and is listed among the templates
+the analyzer could not read.
 
 The analyzer never assumes escaping where it cannot read the template. That covers a
 template file it cannot read, a template named by an expression, a template found