geckon01/Twig
1
0
Fork 0
mirror of https://github.com/twigphp/Twig.git synced 2026-08-17 11:41:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add regression tests that always-allowed callables still enforce the sandbox __toString policy on arguments

Browse Source
This commit is contained in:
Fabien Potencier
2026-06-02 22:07:37 +02:00
parent 7fd87a381f
commit 1c53b790fb
1 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Extension/SandboxTest.php
+20
View File
@@ -2112,6 +2112,26 @@ EOF
$twig->load('index')->render([]);
}
public function testAlwaysAllowedInSandboxFilterStillEnforcesToStringPolicyOnArguments()
{
$twig = $this->getEnvironment(true, [], ['index' => '{{ obj|safe_upper }}']);
$twig->addFilter(new TwigFilter('safe_upper', static fn (string $s) => strtoupper($s), ['always_allowed_in_sandbox' => true]));
$this->expectException(SecurityNotAllowedMethodError::class);
$this->expectExceptionMessage('Calling "__tostring" method on a "'.FooObject::class.'" object is not allowed');
$twig->load('index')->render(['obj' => new FooObject()]);
}
public function testAlwaysAllowedInSandboxFunctionStillEnforcesToStringPolicyOnArguments()
{
$twig = $this->getEnvironment(true, [], ['index' => '{{ safe_greet(obj) }}']);
$twig->addFunction(new TwigFunction('safe_greet', static fn (string $s) => "hi $s", ['always_allowed_in_sandbox' => true]));
$this->expectException(SecurityNotAllowedMethodError::class);
$this->expectExceptionMessage('Calling "__tostring" method on a "'.FooObject::class.'" object is not allowed');
$twig->load('index')->render(['obj' => new FooObject()]);
}
/**
* @group legacy
*/