mirror of
https://github.com/twigphp/Twig.git
synced 2026-08-28 02:57:12 +00:00
Nicolas Grekas
e36489d352
Both filters consume HTML on the input side. Adding `pre_escape => 'html'`
makes the autoescaper escape attacker-controlled inputs before the filters
process them, so they are no longer reachable via `{{ user_input|inline_css }}`
or `{{ user_input|inky_to_html }}` without an explicit `|raw`.
40 lines
905 B
PHP
40 lines
905 B
PHP
<?php
|
|
|
|
/*
|
|
* This file is part of Twig.
|
|
*
|
|
* (c) Fabien Potencier
|
|
*
|
|
* For the full copyright and license information, please view the LICENSE
|
|
* file that was distributed with this source code.
|
|
*/
|
|
|
|
namespace Twig\Extra\CssInliner;
|
|
|
|
use TijsVerkoyen\CssToInlineStyles\CssToInlineStyles;
|
|
use Twig\Extension\AbstractExtension;
|
|
use Twig\TwigFilter;
|
|
|
|
class CssInlinerExtension extends AbstractExtension
|
|
{
|
|
public function getFilters(): array
|
|
{
|
|
return [
|
|
new TwigFilter('inline_css', [self::class, 'inlineCss'], ['is_safe' => ['html'], 'pre_escape' => 'html']),
|
|
];
|
|
}
|
|
|
|
/**
|
|
* @internal
|
|
*/
|
|
public static function inlineCss(string $body, string ...$css): string
|
|
{
|
|
static $inliner;
|
|
if (null === $inliner) {
|
|
$inliner = new CssToInlineStyles();
|
|
}
|
|
|
|
return $inliner->convert($body, implode("\n", $css));
|
|
}
|
|
}
|