Add docs on Markup about the goal of this class in the context of a sandbox

This commit is contained in:
Fabien Potencier
2026-05-20 08:13:36 +02:00
parent 673f02cb6d
commit b9e6e654af
+9
View File
@@ -14,6 +14,15 @@ namespace Twig;
/**
* Marks a content as safe.
*
* Instances of this class (and any subclass) are trusted by the Twig
* sandbox: method calls and property accesses on a Markup instance bypass
* the SecurityPolicy method/property allowlists. This is by design: Markup
* represents content that has already been deemed safe to output.
*
* As a consequence, when extending this class, you are responsible for
* ensuring that every method and property exposed by your subclass is
* safe to call from a sandboxed template.
*
* @author Fabien Potencier <fabien@symfony.com>
*/
class Markup implements \Countable, \JsonSerializable, \Stringable