vstelmakh / url-highlight-twig-extension Goto Github PK

Overview

The library documentation doesn't advise enough about using urls_to_html filter opening to XSS attacks.

Problem

In fact developers may rely on twig auto escaping for their security and want to use this library to simply convert URLs to html anchors. But as soon as they use the filter any input is now considered safe.

Solution

It would be nice for the default behaviour to NOT consider the whole input string safe, but this may be a back-compatibility issue and so at least would be better to advice user to use {{ text|escape|urls_to_html }} on unsafe strings relying on twig auto escape