geckon01/Twig
1
0
Fork 0
mirror of https://github.com/twigphp/Twig.git synced 2026-09-05 23:17:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Warn about untrusted input with the default Tempest markdown converter

Browse Source
This commit is contained in:
Fabien Potencier
2026-08-27 13:07:34 +02:00
parent 1205b8b6ca
commit be220e6fd8
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/filters/markdown_to_html.rst
+7
View File
@@ -105,6 +105,13 @@ to another implementation (for instance ``ParsedownExtra``, which extends
(``# Title``) instead, and any YAML front matter is parsed out of the
rendered HTML rather than being rendered.
.. caution::
The output of the filter is marked as safe for HTML. The default
``tempest/markdown`` converter passes raw HTML, raw ``@@ ... @@`` blocks,
and unsafe links through, so only use it on trusted input, or pass a
converter configured to sanitize its output to ``TempestMarkdown``.
When using ``twig/extra-bundle``, register your converter as the
``twig.markdown.default`` service to make it the one used by the filter: