fix(security): enable Jinja2 autoescape to prevent XSS in gepa sample

Merge google#5526

## Security Fix: XSS via Jinja2 Template Injection (CWE-79)

### Vulnerability
`contributing/samples/gepa/rater_lib.py` instantiates `jinja2.Environment()` **without** `autoescape=True`. The companion template `rubric_validation_template.txt` renders `{{user_input}}` and `{{model_response}}` without escaping.

### Impact
Since ADK is Google's official framework for building AI agents, developers copy/adapt this sample code into production web applications. Unescaped user-controlled input in Jinja2 templates enables:

- **Cross-Site Scripting (XSS)** — Arbitrary JavaScript execution in browsers
- **Session Hijacking** — Steal cookies/tokens if rendered in web context
- **Phishing** — Inject fake login forms

### Proof of Concept
```python
# user_input: <script>alert("XSS")</script>
# Renders as: <main_prompt><script>alert("XSS")</script></main_prompt>

# model_response: <img src=x onerror=alert("XSS from model")>
# Renders as: <responses><img src=x onerror=alert("XSS from model")></responses>
```

### Changes
1. **rater_lib.py:170** — `jinja2.Environment()` → `jinja2.Environment(autoescape=True)`
2. **rubric_validation_template.txt:158** — `{{user_input}}` → `{{user_input|e}}`
3. **rubric_validation_template.txt:163** — `{{model_response}}` → `{{model_response|e}}`

Defense in depth: `autoescape=True` provides baseline protection, explicit `|e` filters ensure escaping even if autoescape is later disabled.

### References
- CWE-79: Cross-site Scripting (XSS)
- OWASP A7:2017 — Cross-site Scripting
- Jinja2 docs: https://jinja.palletsprojects.com/en/3.1.x/api/#autoescaping

Co-authored-by: Shangjie Chen <deanchen@google.com>
COPYBARA_INTEGRATE_REVIEW=google#5526 from k4w-wak:fix/jinja2-xss-autoescape b5b6d3e
PiperOrigin-RevId: 943549514

Author: 2 people

contributing/samples/integrations/gepa/rater_lib.py

@@ -167,7 +167,7 @@ def __call__(self, messages: list[dict[str, Any]]) -> dict[str, Any]:
     Returns:
       A dictionary containing rating information including score.
     """
-    env = jinja2.Environment()
+    env = jinja2.Environment(autoescape=True)
     env.globals['user_input'] = (
         messages[0].get('parts', [{}])[0].get('text', '') if messages else ''
     )

contributing/samples/integrations/gepa/rater_lib_test.py

@@ -0,0 +1,79 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+import sys
+from unittest import mock
+
+# Mock the retry module before importing rater_lib
+mock_retry_module = mock.MagicMock()
+
+
+def mock_retry_decorator(*args, **kwargs):
+  def decorator(func):
+    return func
+
+  return decorator
+
+
+mock_retry_module.retry = mock_retry_decorator
+sys.modules["retry"] = mock_retry_module
+
+from gepa import rater_lib
+
+
+def test_rater_escapes_html_inputs_to_prevent_xss():
+  """Rater escapes HTML tags in user and model inputs to prevent XSS.
+
+  Setup: Mock genai.Client to return a dummy rating response.
+  Act: Call Rater with messages containing HTML tags.
+  Assert: Verify that the rendered prompt template contains escaped HTML.
+  """
+  # Arrange
+  with mock.patch("google.genai.Client") as mock_client_cls:
+    mock_client = mock_client_cls.return_value
+    mock_generate = mock_client.models.generate_content
+    mock_generate.return_value.text = (
+        "Property: The agent fulfilled the user's primary request.\n"
+        "Evidence: mock evidence\n"
+        "Rationale: mock rationale\n"
+        "Verdict: yes"
+    )
+
+    template_path = (
+        "contributing/samples/integrations/gepa/rubric_validation_template.txt"
+    )
+    rater = rater_lib.Rater(
+        tool_declarations="[]", validation_template_path=template_path
+    )
+
+    messages = [
+        {
+            "role": "user",
+            "parts": [{"text": "<script>alert('XSS')</script>"}],
+        },
+        {
+            "role": "model",
+            "parts": [{"text": "Hello <img src=x onerror=alert(1)>"}],
+        },
+    ]
+
+    # Act
+    rater(messages)
+
+    # Assert
+    assert mock_generate.called
+    call_args = mock_generate.call_args
+    contents = call_args.kwargs["contents"]
+
+    assert "&lt;script&gt;alert(&#39;XSS&#39;)&lt;/script&gt;" in contents
+    assert "Hello &lt;img src=x onerror=alert(1)&gt;" in contents

contributing/samples/integrations/gepa/rubric_validation_template.txt

@@ -155,12 +155,12 @@ Verdict: no
   </available_tools>
 
   <main_prompt>
-  {{user_input}}
+  {{user_input|e}}
   </main_prompt>
 </user_prompt>
 
 <responses>
-{{model_response}}
+{{model_response|e}}
 </responses>
 
 <properties>