Reject Answers in Expected Format

Question

Depending on the request format, Symfony2 returns a response of one type (html, css, json, etc.). This is very noticeable. But if I create a template in a specific format and execute an escape character in this context, but, in the end, the page will be displayed in a different format, it will not risk making the output dangerous?

Example: http://symfony.com/it/doc/current/book/index.html?_format=json

Is there a danger of inadvertently creating a resource that might contain a dangerous exit / unexpected? Is it intentional? Why?

Answer 1

In the case of the official Symfony2 documentation, I think this is intentional. But if you create a template in a specific format and execute an escape character in this context, you can force the formats allowed for the request to be used:

article_show: pattern: /articles/{culture}/{year}/{title}.{_format} defaults: { _controller: AcmeDemoBundle:Article:show, _format: html } requirements: culture: en|fr _format: html|rss year: \d+ 

This example shows the special _format routing _format . Using this parameter, the consistent value becomes the "request format" of the "Request" object. Ultimately, the request format is used for things like setting the Content-Type of the response (for example, the json request format is converted to Content-Type of application / json). It can also be used in the controller to render a different template for each _format value. The _format parameter is a very powerful way to display the same content in different formats. More details ...