diff --git a/tests/Extension/SandboxTest.php b/tests/Extension/SandboxTest.php index 8ec537f1b..c20b18e60 100644 --- a/tests/Extension/SandboxTest.php +++ b/tests/Extension/SandboxTest.php @@ -14,6 +14,7 @@ namespace Twig\Tests\Extension; use Twig\Environment; use Twig\Error\SyntaxError; use Twig\Extension\SandboxExtension; +use Twig\Extension\StringLoaderExtension; use Twig\Loader\ArrayLoader; use Twig\Sandbox\SecurityError; use Twig\Sandbox\SecurityPolicy; @@ -44,6 +45,7 @@ class SandboxTest extends \PHPUnit\Framework\TestCase '1_layout' => '{% block content %}{% endblock %}', '1_child' => "{% extends \"1_layout\" %}\n{% block content %}\n{{ \"a\"|json_encode }}\n{% endblock %}", '1_include' => '{{ include("1_basic1", sandboxed=true) }}', + '1_basic2_include_template_from_string' => '{{ include(template_from_string("{{ name|upper }}"), sandboxed=true) }}', '1_range_operator' => '{{ (1..2)[0] }}', '1_syntax_error_wrapper' => '{% sandbox %}{% include "1_syntax_error" %}{% endsandbox %}', '1_syntax_error' => '{% syntax error }}', @@ -90,6 +92,19 @@ class SandboxTest extends \PHPUnit\Framework\TestCase } } + public function testSandboxUnallowedFilterWithIncludeTemplateFromString() + { + $twig = $this->getEnvironment(false, [], self::$templates); + $twig->addExtension(new StringLoaderExtension()); + try { + $twig->load('1_basic2_include_template_from_string')->render(self::$params); + $this->fail('Sandbox throws a SecurityError exception if an unallowed filter is called'); + } catch (SecurityError $e) { + $this->assertInstanceOf(SecurityNotAllowedFilterError::class, $e, 'Exception should be an instance of Twig_Sandbox_SecurityNotAllowedFilterError'); + $this->assertEquals('upper', $e->getFilterName(), 'Exception should be raised on the "upper" filter'); + } + } + public function testSandboxUnallowedFilter() { $twig = $this->getEnvironment(true, [], self::$templates);