From ba45e06972d46163dc7394495ad4a5916c4f17de Mon Sep 17 00:00:00 2001
From: Frank <frank.van.den.berg@eleaf.com>
Date: Mon, 10 Aug 2026 21:41:53 +0200
Subject: [PATCH] Remove |raw from login error message rendering

Not exploitable today - the only custom auth message data is a
hardcoded resend link - but |raw on a translated exception message is
a latent XSS pattern if a future change ever threads user input
through the auth exception's message data. Twig's default
autoescaping is sufficient here.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 templates/tech/security/login.html.twig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/tech/security/login.html.twig b/templates/tech/security/login.html.twig
index b58f11a..c3f5c13 100644
--- a/templates/tech/security/login.html.twig
+++ b/templates/tech/security/login.html.twig
@@ -6,7 +6,7 @@
 <form method="post">
     {% if error %}
         <div class="alert alert-danger">
-            {{ error.messageKey|trans(error.messageData, 'security')|raw }}
+            {{ error.messageKey|trans(error.messageData, 'security') }}
             {% if error.messageData['%resend_link%'] is defined %}
                 <a href="{{ error.messageData['%resend_link%'] }}">Resend activation link</a>
             {% endif %}