Problem/Motivation

When rendering a twig markup field, the module
* first pipes the twig through a HTML text filter
* only then evaluates twig

See code: https://git.drupalcode.org/project/markup_twig/-/blob/8.x-1.x/markup_twi...

This has some bad consequences:

1) The filter does not see dynamically inserted HTML (e.g. you rely on email obfuscation but the email that twig inserts is not processed)
2) The filter may cough as it sees the twig template which in general is invalid HTML
2a) This break may happen unexpected when updating text format filters
3) Twig may break due to some filter results being invalid twig
3a) This break may happen unexpected when adding some new content

I experienced 2) and 3) in #3150347-6: WSOD and Notices

Proposed resolution

Move the check_markup after executing twig in a #post_render callback.

Comments

geek-merlin created an issue. See original summary.

geek-merlin’s picture

Status: Active » Needs review
StatusFileSize
new9.62 KB

Patch flying in that fixes the issue for me.
This multipatch has one prequel that moves helper functions into a helper class that we then need anyway to implement TrustedCallbackInterface.

anybody’s picture

Hi Axel,

thanks a lot for your effort on this! Great work, I just reviewed it and committed to dev. Let's see if it works well or issues pop up, otherwise we may create a new stable release soon.

Thanks a lot!

  • Anybody committed b7054af on 8.x-1.x
    Issue #3153205 by geek-merlin: Filtering twig breaks sites
    
anybody’s picture

Status: Needs review » Fixed
geek-merlin’s picture

Great. Feel free to ping me if something comes up.

geek-merlin’s picture

Status: Fixed » Needs work

Oops, it seems the MarkupTwigHelpers class from the patch has been forgotten to add. Updating will break without this.

  • Anybody committed feca907 on 8.x-1.x
    Issue #3153205 by geek-merlin, Anybody: Filtering twig breaks sites
    
anybody’s picture

Status: Needs work » Fixed

Damn sorry... missed "git add ." ...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.