8 Commits

Author	SHA1	Message	Date
Nicolas Grekas	84982072c7	Fix XSS by adjusting is_safe annotation on HTML-emitting filters ... The `html_to_markdown` filter emits plain Markdown text, so the `is_safe` annotation is dropped entirely and autoescape now handles its output according to the surrounding context. The `markdown_to_html` and `inline_css` filters emit HTML, not text safe in every escaping context, so `is_safe => ['all']` produced unescaped HTML when their output was interpolated into a JS, CSS or URL context. The annotation is now `is_safe => ['html']`.	2026-05-15 15:14:02 +02:00
Fabien Potencier	861215c507	Fix CS	2026-02-07 09:07:38 +01:00
Fabien Potencier	76062c8d51	Fix CS	2025-01-19 16:54:05 +01:00
Alexander M. Turek	6ddb76bb76	Make data providers static	2024-09-03 16:32:00 +02:00
Fabien Potencier	976cea0403	Fix tests	2024-09-01 22:54:59 +02:00
Fabien Potencier	f5e10e10f1	Fix CS	2024-08-07 19:34:09 +02:00
Fabien Potencier	5193653ecb	Fix CS	2023-10-08 09:05:22 +02:00
Fabien Potencier	1868918724	Move things around	2021-01-01 15:53:48 +01:00