Node field not sanitize on render

Question

I have a form for users who want to add new content on my Drupal 8 website. I render node field on a twig template :

{{ node_field_title.value }}

But field are not sanitized by Drupal. Is it the normal behaviour ?

--> If the title is <script>alert('XSS problem!')</script> the script will be executed.

Drupal 8 documentation says : 'The Twig theme engine now auto escapes everything by default. That means that every string printed from a Twig template (e.g. anything between {{ }}) gets automatically sanitized if no filters are used.'

Answer 1

It seems that there is no autoescaping, at least for Drupal 8.7.3 which the version I tested.
For example:

{{ "<div>Is this escaped?</div>" }}
{{ "<script>alert('NOO!');</script> "}}

These lines are not escaped by default. However:

{{ "<div>Is this escaped?</div>"|escape }}
{{ "<script>alert('NOO!');</script>"|escape}}

These are escaped, so better be safe than sorry and use |escape for the input you're getting from your users.