Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missing content aware escaping #142

Open
mstefan21 opened this issue Sep 21, 2017 · 3 comments
Open

Missing content aware escaping #142

mstefan21 opened this issue Sep 21, 2017 · 3 comments

Comments

@mstefan21
Copy link

{var $hack = "<script>alert('test');</script>"}

{_"Insert hack %param% to website", array(
    'param' => $hack,
)}

If we don't add helper "|noescape", we expect that all parameters of translator will be escaped like in documentation.

Fix should be probably here?

@mstefan21
Copy link
Author

Temporary workaround can lool like the following.

{var $hack = "<script>alert('test');</script>"}
{capture $params['param']}{$hack}{/capture}
{_"Insert hack %param% to website", $params}

@mabar
Copy link

mabar commented Jan 5, 2018

It should be solved in latte macros, probably here
@enumag Any ideas how could we apply latte filters to node args?

@enumag
Copy link
Member

enumag commented Jan 5, 2018

I didn't play around with latte macros for a long time so no idea.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants