6 Commits

Author	SHA1	Message	Date
Nicolas Grekas	84982072c7	Fix XSS by adjusting is_safe annotation on HTML-emitting filters ... The `html_to_markdown` filter emits plain Markdown text, so the `is_safe` annotation is dropped entirely and autoescape now handles its output according to the surrounding context. The `markdown_to_html` and `inline_css` filters emit HTML, not text safe in every escaping context, so `is_safe => ['all']` produced unescaped HTML when their output was interpolated into a JS, CSS or URL context. The annotation is now `is_safe => ['html']`.	2026-05-15 15:14:02 +02:00
Fabien Potencier	976cea0403	Fix tests	2024-09-01 22:54:59 +02:00
Fabien Potencier	aa7c454e2d	Fix CS	2023-12-10 20:34:32 +01:00
Fabien Potencier	69a89e0e77	Move functions for MarkdownExtension	2023-12-09 18:39:03 +01:00
Fabien Potencier	5193653ecb	Fix CS	2023-10-08 09:05:22 +02:00
Fabien Potencier	1868918724	Move things around	2021-01-01 15:53:48 +01:00