FrankandClaude Sonnet 5 ba45e06972 Remove |raw from login error message rendering ...

Not exploitable today - the only custom auth message data is a
hardcoded resend link - but |raw on a translated exception message is
a latent XSS pattern if a future change ever threads user input
through the auth exception's message data. Twig's default
autoescaping is sufficient here.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-08-10 21:41:53 +02:00

..

login.html.twig

Remove |raw from login error message rendering

2026-08-10 21:41:53 +02:00