2 Commits

Author	SHA1	Message	Date
Fabien Potencier	9c6d76b61c	Add void return type hint even in tests	2026-07-12 13:43:08 +02:00
Nicolas Grekas	e36489d352	Pre-escape HTML input on inline_css and inky_to_html filters ... Both filters consume HTML on the input side. Adding `pre_escape => 'html'` makes the autoescaper escape attacker-controlled inputs before the filters process them, so they are no longer reachable via `{{ user_input|inline_css }}` or `{{ user_input|inky_to_html }}` without an explicit `|raw`.	2026-05-15 15:14:14 +02:00