From be220e6fd8be4bf2c654297215c6b91d8bae20c1 Mon Sep 17 00:00:00 2001 From: Fabien Potencier Date: Thu, 27 Aug 2026 13:07:34 +0200 Subject: [PATCH] Warn about untrusted input with the default Tempest markdown converter --- doc/filters/markdown_to_html.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/doc/filters/markdown_to_html.rst b/doc/filters/markdown_to_html.rst index 4218ed37c..b5e03d443 100644 --- a/doc/filters/markdown_to_html.rst +++ b/doc/filters/markdown_to_html.rst @@ -105,6 +105,13 @@ to another implementation (for instance ``ParsedownExtra``, which extends (``# Title``) instead, and any YAML front matter is parsed out of the rendered HTML rather than being rendered. +.. caution:: + + The output of the filter is marked as safe for HTML. The default + ``tempest/markdown`` converter passes raw HTML, raw ``@@ ... @@`` blocks, + and unsafe links through, so only use it on trusted input, or pass a + converter configured to sanitize its output to ``TempestMarkdown``. + When using ``twig/extra-bundle``, register your converter as the ``twig.markdown.default`` service to make it the one used by the filter: