Creating filters that work on different safety contexts is currently not possible. Let’s say I want to create an air_quotes filter that puts a " around some words and I want it to work on HTML but also on plain text.
-
Using default filter settings, the result is always unsafe for HTML, so this only works for plain text.
-
Using 'pre_escape' => 'html', 'is_safe' => ['html'] and " as the quote character in my callback works fine for HTML, but cannot be used in plain text contexts because everything gets HTML encoded.
-
Using 'preserves_safety' => ['html'] mostly works, but because the characters my filter wants to inject into the text are reserved in HTML, this is unsafe.
For option 3 to work safely, my filter needs to know if the source text is safe for HTML or not. It then could encode it’s own modifications accordingly so that it can guarantee that the “safety is preserved”.
My current solution for this problem is: Create one air_quotes filter using option 1 for plain text and create another air_quotes_html filter using option 2.
Because of that I would like to propose the needs_safety option for the TwigFilter class. If enabled this would prepend the arguments list of the filter callback with the value of ->getSafe($node) from its values node.
If you agree, I’d like to create a pull request to add that feature.
Creating filters that work on different safety contexts is currently not possible. Let’s say I want to create an
air_quotesfilter that puts a"around some words and I want it to work on HTML but also on plain text.Using default filter settings, the result is always unsafe for HTML, so this only works for plain text.
Using
'pre_escape' => 'html', 'is_safe' => ['html']and"as the quote character in my callback works fine for HTML, but cannot be used in plain text contexts because everything gets HTML encoded.Using
'preserves_safety' => ['html']mostly works, but because the characters my filter wants to inject into the text are reserved in HTML, this is unsafe.For option 3 to work safely, my filter needs to know if the source text is safe for HTML or not. It then could encode it’s own modifications accordingly so that it can guarantee that the “safety is preserved”.
My current solution for this problem is: Create one
air_quotesfilter using option 1 for plain text and create anotherair_quotes_htmlfilter using option 2.Because of that I would like to propose the
needs_safetyoption for theTwigFilterclass. If enabled this would prepend the arguments list of the filter callback with the value of->getSafe($node)from its values node.If you agree, I’d like to create a pull request to add that feature.