Document that alternate Drupal 8 theme engines must implement auto-escape or they are not secure

Definitely, thanks for this.

@corbacho in #1537050-53: [meta] Should we keep / improve multiple theme engine functionality? points out that:

1. https://www.drupal.org/node/1918824 is one place this should be documented
2. Drupal 8 is in fact still shipping with PHPTemplate at the moment (!). Surprised me, but it's true.

I think it would make sense for core to add a simple handy procedural wrapper, something like:

function safe($text) {
  return SafeMarkup::escape($text);
}

That way all it takes for an alternative theme engine such as PHPTemplate to be safe is to do this everywhere in the template:

print safe($variable);

rather than:

print $variable;

Of course the wrapper isn't strictly necessary, but it's a good place to document things, and asking people to deal with namespaces in a .tpl.php file would be painful. It's similar to how Drupal 7 introduced functions like hide(), show(), and render() to make life a little easier on themers.

Just a bit of a start

Great start thanks @cilefen!

+++ b/core/lib/Drupal/Core/Render/theme.api.php
@@ -704,6 +704,12 @@ function hook_extension() {
+ * \Drupal\Component\Utility\SafeStringInterface. Drupal is inherently unsafe if

This is \Drupal\Component\Render\MarkupInterface now as of #2576533: Rename SafeStringInterface to MarkupInterface and move related classes.

I'm curious whether we could point to the nyan cat test one as an example?

Nyan cat engine is simple example how to implement auto escape. I was wondering, maybe we could add some extra docs there and then use it as reference.

Bump

LGTM

#12 and #13 haven't been answered? I looked at nyan_cat_render_template() - I'm not sure though there is that much to be gained though since the docs added point to theme_render_and_autoescape() and that's really all that nyan_cat_render_template() calls. I'll ping @dawehner and @lauriii.

While I get your point I think seeing that implementing auto-escaping would actually not be hard on a real instance might be motivating for people to do so. On the other hand, yeah, I'm totally fine with not adding the pointer.