Why precisely the twig raw filter is insecure in the drupal context?

What would be an example of a potential threat ?

And what need to be done on the ckeditor field format side to protect potential malicious code, if the raw filter is used ?


1 Answer 1


Twig templates escape special characters to prevent potential hacking. Twig raw puts out the data without escaping it, meaning that if it is user-supplied data, it's insecure and could be used for hacking.

  • is the admin/config/content/formats/manage/basic_html limitations and filter not protective enough ? would u have an example ?
    – Matoeil
    Commented Feb 22, 2023 at 14:50
  • 1
    There are multiple levels of filters. Twig filters are just one of them.
    – Jaypan
    Commented Feb 22, 2023 at 14:53
  • 1
    @Matoeil, when you have filtered with a text format you don't need |raw because the filtered markup is already marked as safe.
    – 4uk4
    Commented Feb 22, 2023 at 15:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.