Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Using the apply tag causes double-escaping #4383

Open
kriswillis opened this issue Oct 8, 2024 · 2 comments
Open

Using the apply tag causes double-escaping #4383

kriswillis opened this issue Oct 8, 2024 · 2 comments

Comments

@kriswillis
Copy link

The following twig template:

{% set foo = "Something's not right" %}
<pre>
    {{- foo }}
    {%~ apply lower %}{{ foo }}{% endapply -%}
</pre>

…produces the following HTML output:

<pre>Something&#039;s not right
something&amp;#039;s not right</pre>

…which is rendered as:

Something's not right
something&#039;s not right

I'm currently working around this by using the raw filter within the apply tag:

{% set foo = "Something's not right" %}
<pre>
    {{- foo }}
    {%~ apply lower|raw %}{{ foo }}{% endapply -%}
</pre>
➜ symfony composer show | grep twig   
symfony/twig-bridge                 v6.4.12 Provides integration for Twig with various Symfony components
symfony/twig-bundle                 v6.4.12 Provides a tight integration of Twig into the Symfony full-stack framework
twig/cssinliner-extra               v3.13.0 A Twig extension to allow inlining CSS
twig/extra-bundle                   v3.13.0 A Symfony bundle for extra Twig extensions
twig/inky-extra                     v3.13.0 A Twig extension for the inky email templating engine
twig/twig                           v3.14.0 Twig, the flexible, fast, and secure template language for PHP
@fabpot
Copy link
Contributor

fabpot commented Feb 8, 2025

Playground

@fabpot
Copy link
Contributor

fabpot commented Feb 9, 2025

The way it works currently is that the apply call is done after the evaluation of the content, so on the already escaped content. While some filters might be safe to apply on an already escaped content (lower being of of them), this is generally not the case (upper is not for instance). From the core list of filters, I think (to be double checked) only lower and trim could be marked as safe.

So, I would say that this is a "won't fix" as explicitely using raw here makes sense as it allows to clearly signal the intention of the developer.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

No branches or pull requests

2 participants