$template, 'html' => <<addExtension(new MarkdownExtension()); $twig->addRuntimeLoader(new class($class) implements RuntimeLoaderInterface { private $class; public function __construct(string $class) { $this->class = $class; } public function load(string $c): ?object { return MarkdownRuntime::class === $c ? new $c(new $this->class()) : null; } }); $this->assertMatchesRegularExpression('{'.$expected.'}m', trim($twig->render('index'))); } } public static function getMarkdownTests() { return [ [<<Hello\n+

Great!

"], [<<Hello\n+

Great!

"], ["{{ include('html')|markdown_to_html }}", "

Hello

\n+

Great!

"], ]; } public function testMarkdownToHtmlIsNotSafeInJsContext() { $twig = new Environment(new ArrayLoader([ 'index' => "{% autoescape 'js' %}{{ '# Hello'|markdown_to_html }}{% endautoescape %}", ])); $twig->addExtension(new MarkdownExtension()); $twig->addRuntimeLoader(new class implements RuntimeLoaderInterface { public function load(string $c): ?object { return MarkdownRuntime::class === $c ? new $c(new DefaultMarkdown()) : null; } }); $output = $twig->render('index'); $this->assertStringNotContainsString('

', $output); $this->assertMatchesRegularExpression('{\\\\u003[Cc]h1\\\\u003[Ee]Hello\\\\u003[Cc]\\\\/h1\\\\u003[Ee]}', $output); } }