diff --git c/core/lib/Drupal/Component/Utility/SafeMarkup.php w/core/lib/Drupal/Component/Utility/SafeMarkup.php index 871cf74..d0e885d 100644 --- c/core/lib/Drupal/Component/Utility/SafeMarkup.php +++ w/core/lib/Drupal/Component/Utility/SafeMarkup.php @@ -8,10 +8,14 @@ namespace Drupal\Component\Utility; /** - * Marks strings that are already escaped for XSS prevention. + * Manages known safe strings for rendering at the theme layer. * - * @todo Add detailed documentation about how to use SafeMarkup and how it is - * handled during rendering and in the theme layer. + * As Twig autoescapes string variables in the template, it is possible for a + * string of markup to become double-escaped. SafeMarkup provides a store for + * known safe strings and methods to manage them throughout the page request. + * This class should be limited to interal use only. Module developers should + * instead use render arrays or String::checkPlain() or Xss::filter() to + * sanitize strings for output. * * @see sanitization */