dongshao5573 2014-09-04 13:55
浏览 62


I'm using Twig in my Symfony project.

Symfony should enable autoescape by default. However it doesn't do this by default and after I enable it by hand it still won't work.

I've configured Twig to autoescape all my variables.

    autoescape:   true

But this doesn't filter anything. Both HTML and JavaScript aren't escaped. There is no custom autoescape_service and I'm not filtering the variables with |raw or { autoescape false }.

I've double check the generated config to make sure the value hasn't been overwritten. In app/cache/dev/appDevDebugProjectContainer.xml under the twig service definition the arguments are as follows:

<argument key="debug">true</argument>
<argument key="strict_variables">false</argument>
<argument key="cache">false</argument>
<argument key="autoescape">true</argument>
<argument key="exception_controller">twig.controller.exception:showAction</argument>
<argument key="autoescape_service">null</argument>
<argument key="autoescape_service_method">null</argument>
<argument key="charset">UTF-8</argument>

Is there another way that Twig overwrites the autoescape option that I'm missing? Or how can I force enable it?

  • 写回答

1条回答 默认 最新

  • duanhuokuang5280 2014-09-04 14:20

    I always find the problem after asking my questions after wasting hours trying to find a solution.

    During development twig.autoescape was set to false. Later XSS protection was needed. And and {{ autoescape }} block was added to some of the fields. Some time later a |raw filter has been added in the autoescape block to disable autoescaping on some fields again.

    I missed the |raw filters in the unnecessary autoescape blocks. (I must have skipped the content thinking autoescape was set to true, but the |raw filter gets applied later so the content stays raw.

    本回答被题主选为最佳回答 , 对您是否有帮助呢?



  • ¥20 对D盘进行分盘之前没有将visual studio2022卸载掉,现在该如何下载回来
  • ¥15 加一个K2暂停音乐的功能
  • ¥15 完成虚拟机环境配置,还有安装kettle
  • ¥15 2024年全国大学生数据分析大赛A题:直播带货与电商产品的大数据分析 问题5. 请设计一份优惠券的投放策略,需要考虑优惠券的数量、优惠券的金额、投放时间段和投放商品种类等因素。求具体的python代码
  • ¥15 有人会搭建生鲜配送自营+平台的管理系统吗
  • ¥15 用matlab写代码
  • ¥30 motoradmin系统的多对多配置
  • ¥15 求组态王串口自定义通信配置方法或代码?
  • ¥15 实验 :UML2.0 结构建模
  • ¥20 用vivado写数字逻辑实验报告撰写,FPGA实验