diff --git a/src/Extension/SandboxExtension.php b/src/Extension/SandboxExtension.php index 7f9f7ed35..09ea286e7 100644 --- a/src/Extension/SandboxExtension.php +++ b/src/Extension/SandboxExtension.php @@ -90,7 +90,7 @@ final class SandboxExtension extends AbstractExtension public function ensureToStringAllowed($obj) { - if ($this->isSandboxed() && \is_object($obj)) { + if ($this->isSandboxed() && \is_object($obj) && method_exists($obj, '__toString')) { $this->policy->checkMethodAllowed($obj, '__toString'); } diff --git a/src/Node/CheckSecurityNode.php b/src/Node/CheckSecurityNode.php index d9bdcfd49..59857ca5a 100644 --- a/src/Node/CheckSecurityNode.php +++ b/src/Node/CheckSecurityNode.php @@ -45,12 +45,13 @@ class CheckSecurityNode extends Node } $compiler + ->write("\$this->sandbox = \$this->env->getExtension('\Twig\Extension\SandboxExtension');\n") ->write('$tags = ')->repr(array_filter($tags))->raw(";\n") ->write('$filters = ')->repr(array_filter($filters))->raw(";\n") ->write('$functions = ')->repr(array_filter($functions))->raw(";\n\n") ->write("try {\n") ->indent() - ->write("\$this->extensions[SandboxExtension::class]->checkSecurity(\n") + ->write("\$this->sandbox->checkSecurity(\n") ->indent() ->write(!$tags ? "[],\n" : "['".implode("', '", array_keys($tags))."'],\n") ->write(!$filters ? "[],\n" : "['".implode("', '", array_keys($filters))."'],\n") diff --git a/src/Node/ModuleNode.php b/src/Node/ModuleNode.php index 5e11761fc..d68b639d5 100644 --- a/src/Node/ModuleNode.php +++ b/src/Node/ModuleNode.php @@ -317,8 +317,8 @@ class ModuleNode extends Node } $compiler - ->outdent() ->subcompile($this->getNode('constructor_end')) + ->outdent() ->write("}\n\n") ; } diff --git a/src/Node/SandboxNode.php b/src/Node/SandboxNode.php index 9889d65cf..4697bd45e 100644 --- a/src/Node/SandboxNode.php +++ b/src/Node/SandboxNode.php @@ -29,16 +29,15 @@ class SandboxNode extends Node { $compiler ->addDebugInfo($this) - ->write("\$sandbox = \$this->extensions[SandboxExtension::class];\n") - ->write("if (!\$alreadySandboxed = \$sandbox->isSandboxed()) {\n") + ->write("if (!\$alreadySandboxed = \$this->sandbox->isSandboxed()) {\n") ->indent() - ->write("\$sandbox->enableSandbox();\n") + ->write("\$this->sandbox->enableSandbox();\n") ->outdent() ->write("}\n") ->subcompile($this->getNode('body')) ->write("if (!\$alreadySandboxed) {\n") ->indent() - ->write("\$sandbox->disableSandbox();\n") + ->write("\$this->sandbox->disableSandbox();\n") ->outdent() ->write("}\n") ; diff --git a/src/NodeVisitor/SandboxNodeVisitor.php b/src/NodeVisitor/SandboxNodeVisitor.php index 44ac946b5..507206db5 100644 --- a/src/NodeVisitor/SandboxNodeVisitor.php +++ b/src/NodeVisitor/SandboxNodeVisitor.php @@ -75,7 +75,7 @@ final class SandboxNodeVisitor extends AbstractNodeVisitor if ($node instanceof ModuleNode) { $this->inAModule = false; - $node->setNode('display_start', new Node([new CheckSecurityNode($this->filters, $this->tags, $this->functions), $node->getNode('display_start')])); + $node->setNode('constructor_end', new Node([new CheckSecurityNode($this->filters, $this->tags, $this->functions), $node->getNode('display_start')])); } return $node; diff --git a/src/Template.php b/src/Template.php index e6740e21d..669d36054 100644 --- a/src/Template.php +++ b/src/Template.php @@ -39,6 +39,7 @@ abstract class Template protected $blocks = []; protected $traits = []; protected $extensions = []; + protected $sandbox; public function __construct(Environment $env) { diff --git a/test/Twig/Tests/Node/SandboxTest.php b/test/Twig/Tests/Node/SandboxTest.php index 85bba0d15..7dd3e08f0 100644 --- a/test/Twig/Tests/Node/SandboxTest.php +++ b/test/Twig/Tests/Node/SandboxTest.php @@ -32,13 +32,12 @@ class Twig_Tests_Node_SandboxTest extends NodeTestCase $tests[] = [$node, <<extensions[SandboxExtension::class]; -if (!\$alreadySandboxed = \$sandbox->isSandboxed()) { - \$sandbox->enableSandbox(); +if (!\$alreadySandboxed = \$this->sandbox->isSandboxed()) { + \$this->sandbox->enableSandbox(); } echo "foo"; if (!\$alreadySandboxed) { - \$sandbox->disableSandbox(); + \$this->sandbox->disableSandbox(); } EOF ]; diff --git a/test/Twig/Tests/Node/SandboxedPrintTest.php b/test/Twig/Tests/Node/SandboxedPrintTest.php index 18f7d11f6..df7b35cf5 100644 --- a/test/Twig/Tests/Node/SandboxedPrintTest.php +++ b/test/Twig/Tests/Node/SandboxedPrintTest.php @@ -9,12 +9,9 @@ * file that was distributed with this source code. */ -use Twig\Node\Expression\ArrayExpression; use Twig\Node\Expression\ConstantExpression; -use Twig\Node\Expression\GetAttrExpression; use Twig\Node\Expression\NameExpression; use Twig\Node\SandboxedPrintNode; -use Twig\Template; use Twig\Test\NodeTestCase; class Twig_Tests_Node_SandboxedPrintTest extends NodeTestCase