symfony/TwigBridge — pull request #2 by arthens (2013-05-16 00:11:40+00:00)
Title: Add autoescaped trans block

Disclaimer: this is a proof of concept and not a proper pull request. There are no tests, naming is kind-of-random and code is more duplicated than it should be.
I just want to get an opinion regarding whether this is a viable feature/solution. I apologize if a pull request is not the best way to do it.

## The problem

Twig autoescapes all values by default. This is a great feature because it makes the application xss-safe, and forces developers to opt-out from it if they need it. Which means that it's extremely hard to forget about xss (I'm assuming that if you disable escaping for a particular function/variable you know what you are doing)

However, the `trans` block doesn't support autoescaping, which means that the responsibility to escape unsafe data is back on developers (according to the documentation the `trans` filter escapes everything by default, but that doesn't help much with the problem)

## The proposal

I wrote 2 new blocks: `safetrans` and `safetranschoice`. These 2 blocks are standard twig blocks, which means you can do:

```
{% safetrans %}
Hello {{ user }}, welcome on {{ website }}
{% endsafetrans %}
```
and as a result they inherit the awesome autoescaping logic of twig (they can only contain `print` and `text` nodes).

## How it works

`SafeTransTokenParser` let the Twig parser parse the content of the body, and then it extracts the message, and the nodes containing the expressions to be injected in the message.

The compiled version of the message is:

`Hello %1%, welcome on %2%`

and the expressions are wrapped in a `AutoescapedValue`, which extends `Print` but redefines the compile method (this is a hack because only print nodes get escaped, but in this case we don't want to print it. There might be a better way of doing it.

I've also updated `TranslationNodeVisitor` to support this new node, so the extraction of strings should be exactly as it was before.

## The result

The result is that autoescaping works like in every other Twig block, which should help making safer system.

## Questions

1. What was the reason for using `%token%` instead of `{{ token }}` in the first place? Was it to be "closer" to standard gettext or are there other problems that come with the use of `{{ token }}`?
2. Is the missing support for autoescape just a consequence of using `%token%` or is there something else in gettext that clashes with it?
3. Regardless whether this is the right way or not, is a better support for autoescape in the roadmap for future versions?

Thanks!