Why precisely the twig raw filter is insecure in the drupal context?
What would be an example of a potential threat ?
And what need to be done on the ckeditor field format side to protect potential malicious code, if the raw filter is used ?
2
-
1This is all documented: drupal.org/docs/security-in-drupal/…– cilefenFeb 22 at 16:59
-
See How do I get the raw field value in a twig template? to do it safely.– No SssweatFeb 24 at 11:23
Add a comment
|
1 Answer
Twig templates escape special characters to prevent potential hacking. Twig raw puts out the data without escaping it, meaning that if it is user-supplied data, it's insecure and could be used for hacking.
-
is the admin/config/content/formats/manage/basic_html limitations and filter not protective enough ? would u have an example ?– MatoeilFeb 22 at 14:50
-
1
-
1@Matoeil, when you have filtered with a text format you don't need
|rawbecause the filtered markup is already marked as safe.– 4uk4Feb 22 at 15:24