geckon01/Twig
1
0
Fork 0
mirror of https://github.com/twigphp/Twig.git synced 2026-09-14 03:16:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

security #cve- Fix a security issue on filesystem loader (possibility to load a template outside a configured directory) (fabpot)

Browse Source 
This PR was merged into the 1.x branch.
This commit is contained in:
Fabien Potencier
2022-09-28 10:36:08 +02:00
parent ae39480f01 f8009347c4
commit 35f3035c5d
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Loader/FilesystemLoader.php
+2 -2
View File
@@ -221,9 +221,9 @@ class FilesystemLoader implements LoaderInterface, ExistsLoaderInterface, Source
}
try {
$this->validateName($name);
list($namespace, $shortname) = $this->parseName($name);
$this->validateName($shortname);
} catch (LoaderError $e) {
if (!$throw) {
return false;
tests/Loader/FilesystemTest.php
+5
View File
@@ -31,6 +31,7 @@ class FilesystemTest extends \PHPUnit\Framework\TestCase
public function testSecurity($template)
{
$loader = new FilesystemLoader([__DIR__.'/../Fixtures']);
$loader->addPath(__DIR__.'/../Fixtures', 'foo');
try {
$loader->getCacheKey($template);
@@ -62,6 +63,10 @@ class FilesystemTest extends \PHPUnit\Framework\TestCase
['filters\\\\..\\\\..\\\\AutoloaderTest.php'],
['filters\\//../\\/\\..\\AutoloaderTest.php'],
['/../AutoloaderTest.php'],
['@__main__/../AutoloaderTest.php'],
['@foo/../AutoloaderTest.php'],
['@__main__/../../AutoloaderTest.php'],
['@foo/../../AutoloaderTest.php'],
];
}