fixed sandbox security issue

lib/Twig/Template.php

@@ -154,6 +154,11 @@ abstract class Twig_Template implements Twig_TemplateInterface
         }
 
         if (null !== $template) {
+            // avoid RCEs when sandbox is enabled
+            if (!$template instanceof Twig_Template) {
+                throw new \LogicException('A block must be a method on a Twig_Template instance.');
+            }
+
             try {
                 $template->$block($context, $blocks);
             } catch (Twig_Error $e) {

test/Twig/Tests/TemplateTest.php

@@ -10,6 +10,15 @@
  */
 class Twig_Tests_TemplateTest extends PHPUnit_Framework_TestCase
 {
+    /**
+     * @expectedException LogicException
+     */
+    public function testDisplayBlocksAcceptTemplateOnlyAsBlocks()
+    {
+        $template = $this->getMockForAbstractClass('Twig_Template', array(), '', false);
+        $template->displayBlock('foo', array(), array('foo' => array(new stdClass(), 'foo')));
+    }
+
     /**
      * @dataProvider getAttributeExceptions
      */