See my sandbox for a background, links and proof of concept code.
According to the berkeley paper linked there proper (context stack aware) autosanitization would be a USP in the FOSS market.
Of course no chance to get it complete in D8 core but hopefully a chance to prepare it to be done in contrib.
I have prepared the technical basics but the research what our twig implementation needs for this is beyound my insight.
First step agreed with chx: #1751486: Add context to TemplateData class
Comments
Comment #1
geek-merlinSetting to core and needs-architectural-review to get it rolling.
Comment #1.0
geek-merlinimproved
Comment #1.1
geek-merlinrefined
Comment #2
star-szrIf I'm not mistaken, this was handled by #1825952: Turn on twig autoescape by default. Thanks @axel.rutz :)