From cec2b574158da34e0a0e3ac243ce97db3247edf5 Mon Sep 17 00:00:00 2001 From: Tristan Maindron Date: Thu, 6 Feb 2014 17:32:36 +0100 Subject: [PATCH] Added disambiguation on using raw in expressions --- doc/filters/raw.rst | 24 ++++++++++++++++++++++++ doc/tags/autoescape.rst | 15 ++++++++++++++- 2 files changed, 38 insertions(+), 1 deletions(-) diff --git a/doc/filters/raw.rst b/doc/filters/raw.rst index a9900c7..065e577 100644 --- a/doc/filters/raw.rst +++ b/doc/filters/raw.rst @@ -10,3 +10,27 @@ if ``raw`` is the last filter applied to it: {% autoescape %} {{ var|raw }} {# var won't be escaped #} {% endautoescape %} + +.. note:: + + Be careful when using the ``raw`` filter inside expressions. This + snippet illustrates a case that can be confusing : + + .. code-block:: jinja + + {% autoescape %} + {% set hello = 'Hello' %} + {% set hola = 'Hola' %} + + {{ false ? 'Hola' : hello|raw }} + does not render the same as + {{ false ? hola : hello|raw }} + but renders the same as + {{ (false ? hola : hello)|raw }} + {% endautoescape %} + + The first ternary won't be escaped : ``hello`` is marked as being safe and + Twig does not escape static values (see :doc:`escape<../tags/autoescape>`). + In the second ternary, even if ``hello`` is marked as safe, ``hola`` + remains unsafe and so will be the whole expression. On the other hand, the + third ternary will be marked as safe and the result won't be escaped. \ No newline at end of file diff --git a/doc/tags/autoescape.rst b/doc/tags/autoescape.rst index c5ff0c2..09f8d47 100644 --- a/doc/tags/autoescape.rst +++ b/doc/tags/autoescape.rst @@ -67,5 +67,18 @@ Functions returning template data (like :doc:`macros` and .. note:: + Twig does not escape static expressions : + + .. code-block:: jinja + + {% set hello = "Hello" %} + {{ hello }} + {{ "world" }} + + Will be rendered "Hello **world**". + + +.. note:: + The chapter :doc:`Twig for Developers<../api>` gives more information - about when and how automatic escaping is applied. + about when and how automatic escaping is applied. \ No newline at end of file -- 1.7.2.5