在自定义Twig函数中避免使用XSS？

Question

What is the riht way to escape XSS in custom Twig function?

Consider this :

class TwigExtension extends \Twig_Extension
{
    public function getName()
    {
        return 'html_helpers';
    }

    public function getFunctions()
    {
        $options = array(
            'is_safe' => array('html')
        );
        return array(
            new \Twig_SimpleFunction('greating', array($this, 'greating'),$options)
        );
    }

    public function greating($name)
    {
        return "Salut ".$name;
    }  
}

And the call in the template : {{ greating("<script>alert('Sébastien')</script>") }}

It will display the JS alert. How can I avoid this?

Answer 1

You could prevent scripts like that from getting put in by wrapping the name in htmlspecialchars just like the twig escape filter uses internally:

public function greating($name)
{
    return "Salut ".htmlspecialchars($name);
} 

http://twig.sensiolabs.org/doc/filters/escape.html

Internally, escape uses the PHP native htmlspecialchars function for the HTML escaping strategy.