{"action":"created","issue":{"url":"https://api.github.com/repos/timber/timber/issues/1848","repository_url":"https://api.github.com/repos/timber/timber","labels_url":"https://api.github.com/repos/timber/timber/issues/1848/labels{/name}","comments_url":"https://api.github.com/repos/timber/timber/issues/1848/comments","events_url":"https://api.github.com/repos/timber/timber/issues/1848/events","html_url":"https://github.com/timber/timber/issues/1848","id":381346333,"node_id":"MDU6SXNzdWUzODEzNDYzMzM=","number":1848,"title":"Idea: change escaping functions to use Twig filters","user":{"login":"danielpost","id":1713699,"node_id":"MDQ6VXNlcjE3MTM2OTk=","avatar_url":"https://avatars1.githubusercontent.com/u/1713699?v=4","gravatar_id":"","url":"https://api.github.com/users/danielpost","html_url":"https://github.com/danielpost","followers_url":"https://api.github.com/users/danielpost/followers","following_url":"https://api.github.com/users/danielpost/following{/other_user}","gists_url":"https://api.github.com/users/danielpost/gists{/gist_id}","starred_url":"https://api.github.com/users/danielpost/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danielpost/subscriptions","organizations_url":"https://api.github.com/users/danielpost/orgs","repos_url":"https://api.github.com/users/danielpost/repos","events_url":"https://api.github.com/users/danielpost/events{/privacy}","received_events_url":"https://api.github.com/users/danielpost/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-11-15T21:27:07Z","updated_at":"2018-12-01T08:40:46Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"Currently, Timber implements custom WordPress escapers in the following way:\r\n\r\n```\r\n{{ my_content|e('wp_kses_post') }}\r\n```\r\n\r\nThis works great when autoescaping is turned off. However, when autoescaping is enabled (which in my opinion should always be the case, but that's not relevant right now), Twig applies the default escaping strategy after applying the custom escaper, which leads to double escaping and wrong output.\r\n\r\nTo fix this, the escaper needs to be piped through the raw filter:\r\n\r\n```\r\n{{ my_content|e('wp_kses_post')|raw }}\r\n```\r\n\r\nThis works, but feels wrong. Unfortunately, from my research there seems to be no way to mark custom escaper output as safe/raw. However, [it is possible to mark filter output as safe](https://twig.symfony.com/doc/2.x/advanced.html#automatic-escaping).\r\n\r\nThis means that it would be possible to implement the escapers we have in this way:\r\n\r\n```\r\n{{ my_content|wp_kses_post }}\r\n```\r\n\r\nTo me, this better communicates intent and as a bonus is easier to write. Implementation would be trivial, and current escapers could be kept in place for backwards compatiblity. What do you think?\r\n\r\nNote: this was [almost implemented](https://github.com/twigphp/Twig/pull/2441) in Twig itself but the PR was closed due to inactivity."},"comment":{"url":"https://api.github.com/repos/timber/timber/issues/comments/443410558","html_url":"https://github.com/timber/timber/issues/1848#issuecomment-443410558","issue_url":"https://api.github.com/repos/timber/timber/issues/1848","id":443410558,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MzQxMDU1OA==","user":{"login":"gchtr","id":2084481,"node_id":"MDQ6VXNlcjIwODQ0ODE=","avatar_url":"https://avatars2.githubusercontent.com/u/2084481?v=4","gravatar_id":"","url":"https://api.github.com/users/gchtr","html_url":"https://github.com/gchtr","followers_url":"https://api.github.com/users/gchtr/followers","following_url":"https://api.github.com/users/gchtr/following{/other_user}","gists_url":"https://api.github.com/users/gchtr/gists{/gist_id}","starred_url":"https://api.github.com/users/gchtr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gchtr/subscriptions","organizations_url":"https://api.github.com/users/gchtr/orgs","repos_url":"https://api.github.com/users/gchtr/repos","events_url":"https://api.github.com/users/gchtr/events{/privacy}","received_events_url":"https://api.github.com/users/gchtr/received_events","type":"User","site_admin":false},"created_at":"2018-12-01T08:40:46Z","updated_at":"2018-12-01T08:40:46Z","author_association":"MEMBER","body":"I think this is a cool idea! I agree with you that it’s way easier to write, and also to read. And it would make it easier for both developers who enable autoescaping and those who don’t. It would also be in line with #1787.\r\n\r\nDo you want to add a pull request against the master branch for this?"}}
{"actor":{"display_login":"gchtr"}}