mirror of
https://github.com/twigphp/Twig.git
synced 2026-11-03 09:34:54 +00:00
Nicolas Grekas
84982072c7
The `html_to_markdown` filter emits plain Markdown text, so the `is_safe` annotation is dropped entirely and autoescape now handles its output according to the surrounding context. The `markdown_to_html` and `inline_css` filters emit HTML, not text safe in every escaping context, so `is_safe => ['all']` produced unescaped HTML when their output was interpolated into a JS, CSS or URL context. The annotation is now `is_safe => ['html']`.
13 lines
310 B
Plaintext
13 lines
310 B
Plaintext
--TEST--
|
|
"html_to_markdown" filter output is HTML-escaped by autoescape
|
|
--TEMPLATE--
|
|
{{ html|html_to_markdown }}
|
|
---
|
|
{{ html|html_to_markdown|raw }}
|
|
--DATA--
|
|
return ['html' => '<code><img src=x onerror=alert(1)></code>']
|
|
--EXPECT--
|
|
`<img src=x onerror=alert(1)>`
|
|
---
|
|
`<img src=x onerror=alert(1)>`
|