Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The autoescape tag escapes already escaped value by the escape filter #3918

Open
ericmorand opened this issue Nov 26, 2023 · 3 comments
Open

Comments

@ericmorand
Copy link
Contributor

According to the documentation of the autoescape tag:

Twig is smart enough to not escape an already escaped value by the escape filter.

But, when testing TwigPHP, it seems like the autoescape tag actually do escape already escaped value by the escape filter:

{% set br = "<br/>" %}
{% autoescape "css" %}
{{ br|escape('html') }}
{% endautoescape %}

\26 lt\3B br\2F \26 gt\3B

https://twigfiddle.com/qtyoxi

So, which one is correct: TwigPHP implementation or the documentation?

@smnandre
Copy link
Contributor

When using automatic escaping, Twig tries to not double-escape a variable when the automatic escaping strategy is the same as the one applied by the escape filter;

css: escapes a string for the CSS context. CSS escaping can be applied to any string being inserted into CSS and escapes everything except alphanumerics.

Both are correct.

https://twig.symfony.com/doc/3.x/filters/escape.html

@ericmorand
Copy link
Contributor Author

So one of the page of the documentation is wrong.

@stof
Copy link
Member

stof commented Nov 28, 2023

The note on the autoescape documentation is not explicit enough. But value|escape('css') is not already escaped for html. So it is not wrong per se.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

3 participants