fix xss (#2060)

src/Twig/Extensions.php

@@ -31,6 +31,7 @@ class Extensions extends AbstractExtension
             new TwigFilter('multiline_indent', [$this, 'multilineIndent']),
             new TwigFilter('color', [$this, 'color']),
             new TwigFilter('font_contrast', [$this, 'calculateFontContrastColor']),
+            new TwigFilter('nl2str', [$this, 'replaceNewline'], ['pre_escape' => 'html', 'is_safe' => ['html']]),
         ];
     }
 
@@ -113,4 +114,13 @@ class Extensions extends AbstractExtension
     {
         return Constants::HOMEPAGE . '/documentation/' . $url;
     }
+
+    public function replaceNewline($input, string $newline)
+    {
+        if (!\is_string($input)) {
+            return $input;
+        }
+
+        return str_replace(["\r\n", "\n", "\r"], $newline, $input);
+    }
 }