Both filters consume HTML on the input side. Adding `pre_escape => 'html'`
makes the autoescaper escape attacker-controlled inputs before the filters
process them, so they are no longer reachable via `{{ user_input|inline_css }}`
or `{{ user_input|inky_to_html }}` without an explicit `|raw`.
The `html_to_markdown` filter emits plain Markdown text, so the
`is_safe` annotation is dropped entirely and autoescape now handles
its output according to the surrounding context.
The `markdown_to_html` and `inline_css` filters emit HTML, not text
safe in every escaping context, so `is_safe => ['all']` produced
unescaped HTML when their output was interpolated into a JS, CSS or
URL context. The annotation is now `is_safe => ['html']`.
This PR was merged into the 3.x branch.
Discussion
----------
Add .gitignore & .gitattributes to all .gitattributes
Commits
-------
ff327e4163 Add .gitignore & .gitattributes to all .gitattributes
This PR was merged into the 3.x branch.
Discussion
----------
Allow usage of other Markdown converters than CommonMark in LeagueMarkdown
Since the `CommonMarkConverter` from `League\CommonMark` doesn't allow customizing the `Environment` class at construct-time, this simple change allows providing an instance the parent class, so we can both inject a config to the converter AND a custom list of extensions (like `CommonMarkCoreExtension`) via the constructor.
This PR fixes#3581
Commits
-------
81e66e96bf Update LeagueMarkdown.php
This PR was merged into the 3.x branch.
Discussion
----------
Added configuration for commonmark use in twig-extra-bundle.
Following this tweet: https://twitter.com/ramsey/status/1561894460560138241, this PR adds the configuration options for `commonmark` to the `twig-extra-bundle`.
The configuration is added to the `LeagueCommonMarkConverterFactory` and in turn injected in the `CommonMarkConverter`. This way a user can provide the configuration for usage inside twig.
I'm not sure if adding the configuration inside the extension is the way to go.
Hope this helps out at least `@ramsey` :-)
Added `ignoreExtraKeys` to be somewhat future proof in case extra configuration is added later on, and also to be able to provide de configuration for extensions.
Commits
-------
6f20629622 Added configuration for commonmark use in twig-extra-bundle.
This PR was merged into the 3.x branch.
Discussion
----------
Deprecate Twig\ExpressionParser::parseOnlyArguments() and Twig\ExpressionParser::parseArguments()
Commits
-------
960f6762ed Deprecate Twig\ExpressionParser::parseOnlyArguments() and Twig\ExpressionParser::parseArguments()
This PR was merged into the 3.x branch.
Discussion
----------
Fix the intl-extra tests
symfony/intl has updated its data from ICU 75.1 to ICU 76.1, which includes new currency and scripts.
Commits
-------
d69c66643f Fix the intl-extra tests
This PR was merged into the 3.x branch.
Discussion
----------
Prepare IntegrationTestCase for static data providers
Data providers need to be static in PHPUnit 11. Because of this, I'd like to declare the two methods we use as data providers in `IntegrationTestCase` as static in 4.0. This PR prepares that change:
* The non-static `getFixturesDir()` method is replaced with a static `getFixturesDirectory()`.
* Both methods `getTests()` and `getLegacyTests()` are marked as final, so we can declare them static in the next major.
This however means that we're delaying PHPUnit 11 compatibility of integration tests to Twig 4.0. If that's too late for us, we could deprecate the whole `IntegrationTestCase` in favor of a compatible replacement. That's a bigger change, but I would work on it if you think it's worth it.
Commits
-------
18f42038 Prepare IntegrationTestCase for static data providers
Fabien Potencier
Alexandre Daubois
Nicolas Grekas
Matthias Pigulla
Felds Liscia
hubert.lenoir
Tac Tacelosky
jmsche
Javier Eguiluz
Younes ENNAJI
Hannes
Doeke Norg
Christian Flothmann
Nicolas Lemoine
Christophe Coevoet
Dennis Tobar