merged branch stof/preserve_safe (PR #684)

Commits
-------

0cbf5a0 Added an option to mark filters as preserving the safeness

Discussion
----------

Added an option to mark filters as preserving the safeness

Closes #678

I haven't written a test for this yet as I don't know how to provide a stub filter (as none of the core filters use this option) for the setup of the testsuite.

---------------------------------------------------------------------------

by fabpot at 2012-04-07T20:15:36Z

@stof: Can you also add some information in the phpdoc with an example so that people understand more easily when and why you would want to use this new option? Thanks.

---------------------------------------------------------------------------

by fabpot at 2012-04-07T20:16:36Z

Also, adding a unit test that demonstrates the bug you had in #678 would be good.

---------------------------------------------------------------------------

by stof at 2012-04-20T08:33:58Z

@fabpot none of the core filters are using this options, so what is the right way to add a test ?

---------------------------------------------------------------------------

by fabpot at 2012-04-20T08:36:26Z

by defining a filter in the test that uses it.

---------------------------------------------------------------------------

by stof at 2012-04-20T08:39:06Z

but is it possible to register a filter from the tests with the custom stuff used by Twig ?

---------------------------------------------------------------------------

by fabpot at 2012-04-20T08:48:06Z

in integrationTest.php, we already have quite a few functions and filters registered. I would just be a matter of adding a new one.

---------------------------------------------------------------------------

by stof at 2012-04-20T16:17:01Z

@fabpot renamed, tested and squashed

CHANGELOG

@@ -1,6 +1,7 @@
 * 1.7.0 (2012-XX-XX)
 
  * added an error when defining two blocks with the same name in a template
+ * added the preserve_safety option for filters
  * fixed a PHP notice when trying to access a key on a non-object/array variable
  * enhanced error reporting when the template file is an instance of SplFileInfo
  * added Twig_Environment::mergeGlobals()

lib/Twig/Filter.php

@@ -26,6 +26,7 @@ abstract class Twig_Filter implements Twig_FilterInterface
             'needs_environment' => false,
             'needs_context'     => false,
             'pre_escape'        => null,
+            'preserve_safety' => null,
         ), $options);
     }
 
@@ -59,7 +60,12 @@ abstract class Twig_Filter implements Twig_FilterInterface
             return call_user_func($this->options['is_safe_callback'], $filterArgs);
         }
 
-        return array();
+        return null;
+    }
+
+    public function getPreserveSafety()
+    {
+        return $this->options['preserve_safety'];
     }
 
     public function getPreEscape()

lib/Twig/FilterInterface.php

@@ -30,6 +30,8 @@ interface Twig_FilterInterface
 
     function getSafe(Twig_Node $filterArgs);
 
+    function getPreserveSafety();
+
     function getPreEscape();
 
     function setArguments($arguments);

lib/Twig/NodeVisitor/SafeAnalysis.php

@@ -61,7 +61,11 @@ class Twig_NodeVisitor_SafeAnalysis implements Twig_NodeVisitorInterface
             $name = $node->getNode('filter')->getAttribute('value');
             $args = $node->getNode('arguments');
             if (false !== $filter = $env->getFilter($name)) {
-                $this->setSafe($node, $filter->getSafe($args));
+                $safe = $filter->getSafe($args);
+                if (null === $safe) {
+                    $safe = $this->intersectSafe($this->getSafe($node->getNode('node')), $filter->getPreserveSafety());
+                }
+                $this->setSafe($node, $safe);
             } else {
                 $this->setSafe($node, array());
             }

test/Twig/Tests/Fixtures/tags/autoescape/with_preserve_safety_filters.test

@@ -0,0 +1,50 @@
+--TEST--
+"autoescape" tag handles filters preserving the safety
+--TEMPLATE--
+{% autoescape true %}
+
+(preserve_safety is preserving safety for "html")
+
+1. Unsafe values are still unsafe
+( var|preserve_safety|escape )
+{{ var|preserve_safety }}
+
+2. Safe values are still safe
+( var|escape|preserve_safety )
+{{ var|escape|preserve_safety }}
+
+3. Re-escape values that are escaped for an other contexts
+( var|escape_something|preserve_safety|escape )
+{{ var|escape_something|preserve_safety }}
+
+4. Still escape when using filters not declared safe
+( var|escape|preserve_safety|replace({'FABIEN': 'FABPOT'})|escape )
+{{ var|escape|preserve_safety|replace({'FABIEN': 'FABPOT'}) }}
+
+{% endautoescape %}
+--DATA--
+return array('var' => "<Fabien>\nTwig")
+--EXPECT--
+
+(preserve_safety is preserving safety for "html")
+
+1. Unsafe values are still unsafe
+( var|preserve_safety|escape )
+&lt;FABIEN&gt;
+TWIG
+
+2. Safe values are still safe
+( var|escape|preserve_safety )
+&LT;FABIEN&GT;
+TWIG
+
+3. Re-escape values that are escaped for an other contexts
+( var|escape_something|preserve_safety|escape )
+&lt;FABIEN&gt;
+TWIG
+
+4. Still escape when using filters not declared safe
+( var|escape|preserve_safety|replace({'FABIEN': 'FABPOT'})|escape )
+&amp;LT;FABPOT&amp;GT;
+TWIG
+

test/Twig/Tests/integrationTest.php

@@ -238,6 +238,7 @@ class TestExtension extends Twig_Extension
             'escape_and_nl2br' => new Twig_Filter_Method($this, 'escape_and_nl2br', array('needs_environment' => true, 'is_safe' => array('html'))),
             'nl2br'            => new Twig_Filter_Method($this, 'nl2br', array('pre_escape' => 'html', 'is_safe' => array('html'))),
             'escape_something' => new Twig_Filter_Method($this, 'escape_something', array('is_safe' => array('something'))),
+            'preserve_safety' => new Twig_Filter_Method($this, 'preserve_safety', array('preserve_safety' => array('html'))),
             '*_path'           => new Twig_Filter_Method($this, 'dynamic_path'),
             '*_foo_*_bar'      => new Twig_Filter_Method($this, 'dynamic_foo'),
         );
@@ -297,6 +298,11 @@ class TestExtension extends Twig_Extension
         return strtoupper($value);
     }
 
+    public function preserve_safety($value)
+    {
+        return strtoupper($value);
+    }
+
     public function br()
     {
         return '<br />';