3 Commits

Author	SHA1	Message	Date
Fabien Potencier	9c6d76b61c	Add void return type hint even in tests	2026-07-12 13:43:08 +02:00
Nicolas Grekas	e36489d352	Pre-escape HTML input on inline_css and inky_to_html filters ... Both filters consume HTML on the input side. Adding `pre_escape => 'html'` makes the autoescaper escape attacker-controlled inputs before the filters process them, so they are no longer reachable via `{{ user_input|inline_css }}` or `{{ user_input|inky_to_html }}` without an explicit `|raw`.	2026-05-15 15:14:14 +02:00
Nicolas Grekas	84982072c7	Fix XSS by adjusting is_safe annotation on HTML-emitting filters ... The `html_to_markdown` filter emits plain Markdown text, so the `is_safe` annotation is dropped entirely and autoescape now handles its output according to the surrounding context. The `markdown_to_html` and `inline_css` filters emit HTML, not text safe in every escaping context, so `is_safe => ['all']` produced unescaped HTML when their output was interpolated into a JS, CSS or URL context. The annotation is now `is_safe => ['html']`.	2026-05-15 15:14:02 +02:00