twig-audit

Twig Audit

Principle: Twig is for presentation ONLY. Preprocess handles logic.

Audit Workflow

1. Run the detection greps below on the theme/module templates.
2. Read EVERY flagged template in full (grep hits need context to confirm).
3. Classify each confirmed hit against the anti-pattern list (severity: drilling/raw = CRITICAL, logic/isolation = HIGH, attributes = MEDIUM).
4. Produce the report using the Audit Report Format at the end.

Detection Commands

Replace TPL with the templates directory, e.g. $DDEV_DOCROOT/themes/custom/*/templates/:

# Anti-pattern 1: render array drilling — matches content.field_x[0]['#markup'] and ['#items']
grep -rn "\[.['\"]#" TPL ; grep -rn "\['#" TPL

# Anti-pattern 2: business logic — comparisons/calculations on .value inside if/set
grep -rnE "\{% *(if|set) .*\.value" TPL

# Anti-pattern 3: raw filter usage — every hit must be justified
grep -rn "|raw" TPL

# Anti-pattern 4: non-isolated includes — check each hit for "with_context = false" or "only"
grep -rn "include(" TPL ; grep -rn "{% embed" TPL

# Anti-pattern 6: direct entity access bypassing the render system
grep -rn "\.entity\." TPL

# Anti-pattern 7: attributes built as strings
grep -rnE "class=\"[^\"]*\{\{" TPL

A grep hit is a CANDIDATE, not a confirmed issue — always read the template before reporting.

Anti-Patterns to Detect

1. Render Array Drilling (CRITICAL — Breaks Cache)

{# BAD — loses cache metadata, security risk #}
{{ content.field_image[0]['#markup'] }}
{{ content.field_body['#items'][0]['value'] }}

{# GOOD #}
{{ content.field_image }}
{{ content.body }}

2. Business Logic in Templates

{# BAD #}
{% if user.field_role.value == 'premium' and user.field_expiration.value|date('U') > 'now'|date('U') %}
  {% set discount = product.price.value * 0.2 %}

{# GOOD — variable from preprocess #}
{% if has_premium_discount %}
  {{ formatted_discounted_price }}

3. Unsafe |raw Usage

{# BAD — XSS vulnerability #}
{{ node.field_user_content.value|raw }}

{# GOOD — use processed field #}
{{ content.field_user_content }}