Posted by chx on October 20, 2012 at 4:07am
Security was always Drupal's highest priority. However, the theming system was never as secure we wished it was. We are proposing using Twig and its auto escape feature (although any auto escaping theme engine could be used). This raises the problem of double escapes. Read more on the problems and the suggested solutions at http://drupal.org/node/1818266 . Carefully thought out feedback would be much appreciated.