Add autoescape to Jinja environment

Author: mongkok

debug_toolbar/settings.py

@@ -53,7 +53,7 @@ class DebugToolbarSettings(BaseSettings):
         ),
     )
     JINJA_ENV: Environment = Field(
-        Environment(),
+        Environment(autoescape=True),
         description="The Jinja environment instance used to render the toolbar.",
     )
     JINJA_LOADERS: list[BaseLoader] = Field(

debug_toolbar/templates/panels/profiling.html

@@ -1,6 +1,6 @@
 <iframe id="profilingContent">
   <style>.header { display: none; }</style>
-  {{ content }}
+  {{ content | safe }}
 </iframe>
 
 <script>