Escape Html - turn on / set a true by default

[ampmonteiro]

Hi,

Since you release new version (v4) and in future versions, make no sense nowadays the option $smarty->escape_html not be set a true or with $smarty->default_modifiers not without a this option: ['escape:"htmlall"'] .

Because without at least one of the options activated the library is not avoiding XSS attacks. And since you have a section for designers, since people without php knowledge, will forget escape modifier.

Finally, since smarty is a compiler template engine, i think should have the same behavior of others compiled template engine like this standalone template: Twig and Latte . Or like Blade template ( with laravel) .

Thank you.

[wisskid]

Excellent point. I guess we should? Maybe ask the community how they feel about this.

[ampmonteiro]

Hi,

also even this setting change is not applied in current major version of smarty (V4), i recommend that some pages / areas of the docs of v3 and v4 should be updated with some kind of note / warning of not using or not be on the escape_html in order to help to prevent XSS attacks and use security good practice.

Example of some pages / areas in v4 docs:

• Getting started page
• in designers > language-basic-syntax > Introduction page
• in designers > language-variables > Introduction page
• in designers > language-modifiers > Introduction page
• in designers language-modifiers > Introduction page
• in designers language-modifiers > escape page
• in designers language-modifiers > unescape page
• in programmers > intro
• programmers/api-variables/variable-escape-html page

If it is needed to create different issue for this indication for docs, just write a comment confirm it, for late on i will do that. Thanks.

[wisskid]

@ampmonteiro I agree. And yes, please create a different issue for this, that will be helpful.