Why Magento 2 .gitignore File Ignores Itself – Explanation

This tag is used by static tests. Any potentially unsafe output must be marked with either @escapeNotVerified or @noEscape to pass tests, the latter means that this particular usage has been checked and is safe.

In the future releases all occurrences of @escapeNotVerified will be verified and either marked with @noEscape or escaped with one of these methods:

• \Magento\Framework\View\Element\AbstractBlock::escapeHtml
• \Magento\Framework\View\Element\AbstractBlock::escapeUrl
• \Magento\Framework\View\Element\AbstractBlock::escapeXssInUrl
• \Magento\Framework\View\Element\AbstractBlock::escapeQuote

Also note that some output is considered safe and should not be marked with such annotations:

• Enclosed in single quotes
• Enclosed in double quotes but without variables
• Type casting to bool, int
• Method calls which contain 'html' in their names, like getTitleHtml, are also expected to output escaped HTML

In Magento 2.1, this has actually become a lot easier.

A good Example for the implementation is the category form: https://github.com/magento/magento2/blob/develop/app/code/Magento/Catalog/view/adminhtml/ui_component/category_form.xml#L148

Then you also need a Controller for the Image Upload: https://github.com/magento/magento2/blob/develop/app/code/Magento/Catalog/Controller/Adminhtml/Category/Image/Upload.php

And last but not least some logic in the save controller, which hopefully will get refactored soon:

https://github.com/magento/magento2/blob/develop/app/code/Magento/Catalog/Controller/Adminhtml/Category/Save.php#L259 https://github.com/magento/magento2/blob/develop/app/code/Magento/Catalog/Controller/Adminhtml/Category/Save.php#L82