Variables · Question 11 of 12
A template outputs a visitor comment with {comment -> f:format.raw()}. What is the risk?
1 answer is correct. Hard
Show answer
Answer
- C Execution of malicious code (XSS)
Explanation
f:format.raw removes escaping. If the comment contains <script>, it ends up unfiltered in the HTML. User input must therefore be output escaped, as Fluid does by default.