mirror of
https://github.com/twigphp/Twig.git
synced 2026-09-18 05:16:30 +00:00
Nicolas Grekas
e36489d352
Both filters consume HTML on the input side. Adding `pre_escape => 'html'`
makes the autoescaper escape attacker-controlled inputs before the filters
process them, so they are no longer reachable via `{{ user_input|inline_css }}`
or `{{ user_input|inky_to_html }}` without an explicit `|raw`.
35 lines
737 B
PHP
35 lines
737 B
PHP
<?php
|
|
|
|
/*
|
|
* This file is part of Twig.
|
|
*
|
|
* (c) Fabien Potencier
|
|
*
|
|
* For the full copyright and license information, please view the LICENSE
|
|
* file that was distributed with this source code.
|
|
*/
|
|
|
|
namespace Twig\Extra\Inky;
|
|
|
|
use Pinky;
|
|
use Twig\Extension\AbstractExtension;
|
|
use Twig\TwigFilter;
|
|
|
|
class InkyExtension extends AbstractExtension
|
|
{
|
|
public function getFilters(): array
|
|
{
|
|
return [
|
|
new TwigFilter('inky_to_html', [self::class, 'inky'], ['is_safe' => ['html'], 'pre_escape' => 'html']),
|
|
];
|
|
}
|
|
|
|
/**
|
|
* @internal
|
|
*/
|
|
public static function inky(string $body): string
|
|
{
|
|
return false === ($html = Pinky\transformString($body)->saveHTML()) ? '' : $html;
|
|
}
|
|
}
|