php crawler

• Twig GHSA-2g2g-8p8h-fgwm (fixed 3.26.0): Profiler\Dumper\HtmlDumper put Profile::getTemplate()/getName() into sprintf HTML without escaping. The fix added a private escape() using htmlspecialchars(ENT_QUOTES|ENT_SUBSTITUTE,'UTF-8'). Why it matters: Symfony's TwigDataCollector::getHtmlCallGraph() returns the dump as new Twig\Markup, which skips autoescape. So whatever the dumper doesn't escape reaches the web profiler as raw HTML.
• Symfony Bridge CodeExtension (6.4) shows two safe ways to write is_safe=>['html'] filters. abbr_class/abbr_method use 'pre_escape'=>'html', so Twig escapes the input before raw sprintf('<abbr title="%s">'). formatArgs/formatFile call htmlspecialchars on each piece. formatFileFromText only escapes the regex-matched file path and returns the rest of $text as is, so it is safe only if the caller passes text that is already escaped (unverified; it is a debug-only filter).

The template still prints heading cells with |raw, so the fix has to be in PHP. The first hunk removed encoding at normalize time. I want the second hunk to see where it moved.

• GHSA-2g2g-8p8h-fgwm (twig/twig <3.26.0): Profiler\Dumper\HtmlDumper wrote Profile::getTemplate()/getName() into HTML unescaped. In 3.26.0 a private escape() adds htmlspecialchars(ENT_QUOTES|ENT_SUBSTITUTE, UTF-8). The sink that matters is in Symfony: Bridge/Twig/DataCollector/TwigDataCollector::getHtmlCallGraph() returns `new Markup($dump)`, so the web profiler treats the dumper output as trusted HTML. Symfony only gets the fix by upgrading twig.

• Twig GHSA-2g2g-8p8h-fgwm (twig/twig >=3.0,<3.26.0, CWE-79, Low): Profiler\Dumper\HtmlDumper sprintf'd Profile::getTemplate()/getName() into <span> markup raw. The 3.26.0 fix adds a private escape() = htmlspecialchars(ENT_QUOTES|ENT_SUBSTITUTE,'UTF-8') on those values. Profile::getType() is still interpolated unescaped in formatNonTemplate, but it's an internal constant (block/macro/template) and only used as a $colors key with an 'auto' fallback. Low concern, unverified.

• GHSA-jv8m-2544-3pg3 (twig/markdown-extra, cssinliner-extra and other extras <3.26.0, CWE-79): filters that output HTML declared is_safe=>['all']. In src/NodeVisitor/EscaperNodeVisitor.php, isSafeFor() returns true if $safe contains $type OR 'all'. So inside a js, css, url or html_attr autoescape context, the output of markdown_to_html was never escaped. The fix narrows the declaration to ['html'] (MarkdownExtension.php on 3.x now reads is_safe=>['html']).
• Comparison (unverified): drupal/drupal 11.x core/lib/Drupal/Core/Template/TwigExtension.php escapeFilter() returns MarkupInterface and \Twig\Markup values unchanged whenever $autoescape is true, before it ever checks $strategy. Like is_safe=>['all'], this treats "safe for HTML" as "safe in any context" (js/css/url autoescape blocks). A comment says Drupal only supports the html strategy, so this is probably intended. To confirm or rule out, read Drupal docs/issues on non-html autoescape strategies. Its escapeFilterIsSafe() and isUrlGenerationSafe() correctly return context-specific lists (['html'] or the constant strategy).

openrouter 401: {"error":{"message":"User not found.","code":401}}