From ee6965ed00a7118ebe89e0c32d16e11ae7c8c1f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Uwe=20Ja=CC=88ger?= <uwej711@googlemail.com>
Date: Thu, 2 Jun 2016 08:40:59 +0200
Subject: [PATCH] fix a case where the autoescaping does not work as expected

The Twig_NodeVisitor_Escaper collects a list of blocks for all templates that it visits. If you define the same block (i.e. with the same name) in txt and html templates this results sometimes in the html block not being escapes.

This is illustrated in the added test.

To fix it, I propose to reset the list of the blocks for each module.

Alternatively we need to make clear that blocks should not share names between text and html templates.
---
 lib/Twig/NodeVisitor/Escaper.php              |  1 +
 .../Twig/Tests/Fixtures/autoescape/block.test | 21 +++++++++++++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 test/Twig/Tests/Fixtures/autoescape/block.test

diff --git a/lib/Twig/NodeVisitor/Escaper.php b/lib/Twig/NodeVisitor/Escaper.php
index 5c9497774..00c759d15 100644
--- a/lib/Twig/NodeVisitor/Escaper.php
+++ b/lib/Twig/NodeVisitor/Escaper.php
@@ -38,6 +38,7 @@ class Twig_NodeVisitor_Escaper extends Twig_BaseNodeVisitor
                 $this->defaultStrategy = $defaultStrategy;
             }
             $this->safeVars = array();
+            $this->blocks = array();
         } elseif ($node instanceof Twig_Node_AutoEscape) {
             $this->statusStack[] = $node->getAttribute('value');
         } elseif ($node instanceof Twig_Node_Block) {
diff --git a/test/Twig/Tests/Fixtures/autoescape/block.test b/test/Twig/Tests/Fixtures/autoescape/block.test
new file mode 100644
index 000000000..4b38b5b6e
--- /dev/null
+++ b/test/Twig/Tests/Fixtures/autoescape/block.test
@@ -0,0 +1,21 @@
+--TEST--
+blocks and autoescape
+--TEMPLATE--
+{{ include('unrelated.txt.twig') -}}
+{{ include('template.html.twig') -}}
+--TEMPLATE(unrelated.txt.twig)--
+{% block content %}{% endblock %}
+--TEMPLATE(template.html.twig)--
+{% extends 'parent.html.twig' %}
+{% block content %}
+{{ br -}}
+{% endblock %}
+--TEMPLATE(parent.html.twig)--
+{% set _content = block('content')|raw %}
+{{ _content|raw }}
+--DATA--
+return array('br' => '<br />')
+--CONFIG--
+return array('autoescape' => 'filename')
+--EXPECT--
+&lt;br /&gt;