mirror of
https://github.com/twigphp/Twig.git
synced 2026-08-17 08:50:50 +00:00
Nicolas Grekas
e36489d352
Both filters consume HTML on the input side. Adding `pre_escape => 'html'`
makes the autoescaper escape attacker-controlled inputs before the filters
process them, so they are no longer reachable via `{{ user_input|inline_css }}`
or `{{ user_input|inky_to_html }}` without an explicit `|raw`.
Twig CssInliner Extension
This package is a Twig extension that provides the following:
inline_cssfilter: inlines CSS styles in HTML documents.