mirror of
https://github.com/twigphp/Twig.git
synced 2026-09-03 22:17:36 +00:00
Nicolas Grekas
a5f6e8793e
The HtmlDumper output is intended to be rendered in a browser, and the template and macro/block names it interpolates are loader-controlled (e.g. the key for ArrayLoader or a database row id), so they can carry arbitrary HTML when an application stores templates under user-supplied identifiers.