geckon01/Twig
1
0
Fork 0
mirror of https://github.com/twigphp/Twig.git synced 2026-08-31 12:37:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch '2.x' into 3.x

Browse Source 
* 2.x:
  Fix a security issue on filesystem loader (possibility to load a template outside a configured directory)
This commit is contained in:
Fabien Potencier
2022-09-28 10:36:55 +02:00
parent be33323ab1 d6ea14aa84
commit 2e8acd94ca
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Loader/FilesystemLoader.php
+2 -2
View File
@@ -183,9 +183,9 @@ class FilesystemLoader implements LoaderInterface
}
try {
$this->validateName($name);
list($namespace, $shortname) = $this->parseName($name);
$this->validateName($shortname);
} catch (LoaderError $e) {
if (!$throw) {
return null;
tests/Loader/FilesystemTest.php
+5
View File
@@ -32,6 +32,7 @@ class FilesystemTest extends TestCase
public function testSecurity($template)
{
$loader = new FilesystemLoader([__DIR__.'/../Fixtures']);
$loader->addPath(__DIR__.'/../Fixtures', 'foo');
try {
$loader->getCacheKey($template);
@@ -63,6 +64,10 @@ class FilesystemTest extends TestCase
['filters\\\\..\\\\..\\\\AutoloaderTest.php'],
['filters\\//../\\/\\..\\AutoloaderTest.php'],
['/../AutoloaderTest.php'],
['@__main__/../AutoloaderTest.php'],
['@foo/../AutoloaderTest.php'],
['@__main__/../../AutoloaderTest.php'],
['@foo/../../AutoloaderTest.php'],
];
}