Escape user data in server-data.rst

[dave1010]

Escape user data for HTML attributes to prevent XSS.

This is already done in the second code snippet below.

Twig playground demo:

https://twig.symfony.com/play?data=eyJ0ZW1wbGF0ZXMiOltbImluZGV4LnR3aWciLCI8ZGl2IGRhdGEtZm9vPVwiTm90IGVuY29kZWQge3sgbmFtZXxqc29uX2VuY29kZSB9fVwiPlxuXG48ZGl2IGRhdGEtZm9vPVwiRW5jb2RlZCB7eyBuYW1lfGpzb25fZW5jb2RlfGUoJ2h0bWxfYXR0cicpIH19XCI%2BIl1dLCJjb250ZXh0Ijp7Im5hbWUiOiJXb3JsZCJ9LCJ2ZXJzaW9uIjoiMy4yMS4xIiwib3B0aW9ucyI6eyJzdHJpY3RfdmFyaWFibGVzIjp0cnVlLCJjaGFyc2V0IjoiVVRGLTgiLCJhdXRvZXNjYXBlIjoiIn19

[javiereguiluz]

Very nice catch Dave! Thanks for fixing this.

Please note that while merging we did this minor tweak:

-data-user="{{ app.user|serialize(format = 'json')|e('html_attr') }}"
+data-user="{{ app.user|serialize(format = 'json')|e('html') }}"

This is what Twig recommends, for performance reasons, to use for escaping HTML attributes: https://twig.symfony.com/doc/3.x/filters/escape.html

Thanks!