Don't use |raw in Twig templates

Created on 24 June 2025, 3 days ago

Problem/Motivation

Using |raw is a bad security practice and it is almost never necessary with Drupal: https://www.drupal.org/docs/develop/theming-drupal/twig-in-drupal/filter...

Steps to reproduce

Proposed resolution

If the variable contains HTML that should not be escaped, it should be a Markup object instead.

Remaining tasks

User interface changes

API changes

Data model changes

🐛 Bug report
Status

Active

Version

4.0

Component

Footnotes

Created by

🇫🇷France prudloff Lille

Live updates comments and jobs are added and updated live.
  • Security improvements

    It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.

Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.71.5 2024