如何使用Symfony在Twig中启用自动转换

Question

I'm using Twig in my Symfony project.

Symfony should enable autoescape by default. However it doesn't do this by default and after I enable it by hand it still won't work.

I've configured Twig to autoescape all my variables.

twig:
    autoescape:   true

But this doesn't filter anything. Both HTML and JavaScript aren't escaped. There is no custom autoescape_service and I'm not filtering the variables with |raw or { autoescape false }.

I've double check the generated config to make sure the value hasn't been overwritten. In app/cache/dev/appDevDebugProjectContainer.xml under the twig service definition the arguments are as follows:

<argument key="debug">true</argument>
<argument key="strict_variables">false</argument>
<argument key="cache">false</argument>
<argument key="autoescape">true</argument>
<argument key="exception_controller">twig.controller.exception:showAction</argument>
<argument key="autoescape_service">null</argument>
<argument key="autoescape_service_method">null</argument>
<argument key="charset">UTF-8</argument>

Is there another way that Twig overwrites the autoescape option that I'm missing? Or how can I force enable it?

Answer 1

I always find the problem after asking my questions after wasting hours trying to find a solution.

During development twig.autoescape was set to false. Later XSS protection was needed. And and {{ autoescape }} block was added to some of the fields. Some time later a |raw filter has been added in the autoescape block to disable autoescaping on some fields again.

I missed the |raw filters in the unnecessary autoescape blocks. (I must have skipped the content thinking autoescape was set to true, but the |raw filter gets applied later so the content stays raw.