Unescape or html decode in Twig (PHP Templating)

Question

I'm using twig 1.12.2. My code generates some elements from code-behind, when rendering these with the latest version of twig they get html-encoded

{% for item in files_folders %}
<tr class="{{ cycle(['tr_odd', 'tr_even'], loop.index) }}">
    <td><img src="../templates/images/sharepoint/{{ item.ContentType }}.gif" border="0" alt=""/></td>
    <td>{{ item.Link }}</td>
    <td>{{ item.Modified }}</td>
    <td>{{ item.FileSize }}</td>
    <td>{{ item.FileType }}</td>
</tr>
{% endfor %}

This will output this

<tr class="tr_even">
    <td><img src="../templates/images/sharepoint/Document.gif" border="0" alt=""/></td>
    <td>&lt;a href=&#039;?download=/ddd.png&#039;&gt;ddd.png&lt;/a&gt;</td>
    <td>2013-03-04 17:47:38</td>
    <td>64.8 KB</td>
    <td>png</td>
</tr>
<tr class="tr_odd">
    <td><img src="../templates/images/sharepoint/Document.gif" border="0" alt=""/></td>
    <td>&lt;a href=&#039;?download=/asdasd.png&#039;&gt;asdasd.png&lt;/a&gt;</td>
    <td>2013-03-03 20:01:52</td>
    <td>66.04 KB</td>
    <td>png</td>
</tr>

When I debug and have a look at the data before it's sent to twig it is not escaped. I haven't found any alternative to {{ item.Link }} to render data as-is.

Thanks

score 60 · Accepted Answer · edited Nov 28 '15 at 00:44

60

You can use the raw filter to make twig render raw html

http://twig.sensiolabs.org/doc/filters/raw.html

{% autoescape %}
    {{ var|raw }} {# var won't be escaped #}
{% endautoescape %}

edited Nov 28 '15 at 00:44

Pastor Bones

6,895
3
34
56

answered Mar 16 '13 at 19:22

romainberger

4,473
2
32
50

1

Good Answer +1 However, please include an example to ensure your answer stays relevant as links can `die` or become missing. – Pastor Bones Nov 28 '15 at 00:42
4

As always: Please be carefull when using |raw . If you raw user input, you open the gates for XSS. – Rubinum Jun 02 '17 at 13:21

score 18 · Answer 2 · edited Nov 09 '17 at 10:25

18

You should be careful with using |raw. Saying that the data is safe, means you are trusting it 100%.

Personally I would suggest using a custom twig filter:

class CustomExtension extends \Twig_Extension 
{
    public function getFilters()
    {
        return array(
            new \Twig_SimpleFilter('unescape', array($this, 'unescape')),
        );
    }

    public function unescape($value)
    {
        return html_entity_decode($value);
    }
}

Add the following to your services.yml (or alternatively translate into xml).

 services:
     ha.twig.custom_extension:
     class: HA\SiteBundle\Twig\CustomExtension
     tags:
         - { name: twig.extension }

edited Nov 09 '17 at 10:25

Gounzy

23
4

answered Jul 22 '14 at 15:16

Paul Danelli

927
13
25

This is elegant but in applications that are not communities or public facing web sites the 100% trust isn't really an issue :) – Eric Herlitz Jul 23 '14 at 20:45
1

I agree, but it should still be a consideration, protecting the developer from themselves for example. – Paul Danelli Jul 25 '14 at 07:56

score 15 · Answer 3 · answered Oct 11 '16 at 23:58

15

Or http://twig.sensiolabs.org/doc/filters/raw.html

{% autoescape false %}
   {{ your_item }}{# your_item won't be escaped #}
{% endautoescape %}

answered Oct 11 '16 at 23:58

Promo IL

158
1
8

score 5 · Answer 4 · answered Aug 05 '19 at 23:00

If you are using Drupal 8 and none of raw or autoscape works, this could happen because of the variable you're trying to print if it's a render array with a template holding a safe output (for example, a hl2br filter).

I that case, you would need to access the value through the render array and filter it, for instance:

{% autoescape false %}
  {{ item.content['#context']['value'] }}
{% endautoescape %}

Unescape or html decode in Twig (PHP Templating)

4 Answers4

Linked

Related