Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added disambiguation on using raw in expressions #1333

Merged
merged 1 commit into from
Jul 8, 2014
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions doc/filters/raw.rst
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,27 @@ if ``raw`` is the last filter applied to it:
{% autoescape %}
{{ var|raw }} {# var won't be escaped #}
{% endautoescape %}

.. note::

Be careful when using the ``raw`` filter inside expressions. This
snippet illustrates a case that can be confusing :

.. code-block:: jinja

{% autoescape %}
{% set hello = '<strong>Hello</strong>' %}
{% set hola = '<strong>Hola</strong>' %}

{{ false ? '<strong>Hola</strong>' : hello|raw }}
does not render the same as
{{ false ? hola : hello|raw }}
but renders the same as
{{ (false ? hola : hello)|raw }}
{% endautoescape %}

The first ternary won't be escaped : ``hello`` is marked as being safe and
Twig does not escape static values (see :doc:`escape<../tags/autoescape>`).
In the second ternary, even if ``hello`` is marked as safe, ``hola``
remains unsafe and so will be the whole expression. On the other hand, the
third ternary will be marked as safe and the result won't be escaped.
15 changes: 14 additions & 1 deletion doc/tags/autoescape.rst
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,20 @@ Functions returning template data (like :doc:`macros<macro>` and
Twig is smart enough to not escape an already escaped value by the
:doc:`escape<../filters/escape>` filter.

.. note::

Twig does not escape static expressions :

.. code-block:: jinja

{% set hello = "<strong>Hello</strong>" %}
{{ hello }}
{{ "<strong>world</strong>" }}

Will be rendered "<strong>Hello</strong> **world**".


.. note::

The chapter :doc:`Twig for Developers<../api>` gives more information
about when and how automatic escaping is applied.
about when and how automatic escaping is applied.