From 3a67fc7dc577515dda3ee0887d71d542e82fc0b8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michael=20Vo=C5=99=C3=AD=C5=A1ek?= Date: Tue, 6 Apr 2021 03:10:12 +0200 Subject: [PATCH] Fix: A template name cannot be an absolute path --- src/Loader/FilesystemLoader.php | 4 ++++ tests/Loader/FilesystemTest.php | 12 +++++++++++- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/src/Loader/FilesystemLoader.php b/src/Loader/FilesystemLoader.php index 7ca214580..a27a133c0 100644 --- a/src/Loader/FilesystemLoader.php +++ b/src/Loader/FilesystemLoader.php @@ -292,6 +292,10 @@ class FilesystemLoader implements LoaderInterface, ExistsLoaderInterface, Source throw new LoaderError('A template name cannot contain NUL bytes.'); } + if ($this->isAbsolutePath($name)) { + throw new LoaderError(sprintf('A template name cannot be an absolute path (%s).', $name)); + } + $name = ltrim($name, '/'); $parts = explode('/', $name); $level = 0; diff --git a/tests/Loader/FilesystemTest.php b/tests/Loader/FilesystemTest.php index 3307a9b7e..69680c8ac 100644 --- a/tests/Loader/FilesystemTest.php +++ b/tests/Loader/FilesystemTest.php @@ -32,11 +32,13 @@ class FilesystemTest extends \PHPUnit\Framework\TestCase { $loader = new FilesystemLoader([__DIR__.'/../Fixtures']); + $this->expectException(LoaderError::class); try { $loader->getCacheKey($template); - $this->fail(); } catch (LoaderError $e) { $this->assertStringNotContainsString('Unable to find template', $e->getMessage()); + + throw $e; } } @@ -62,6 +64,14 @@ class FilesystemTest extends \PHPUnit\Framework\TestCase ['filters\\\\..\\\\..\\\\AutoloaderTest.php'], ['filters\\//../\\/\\..\\AutoloaderTest.php'], ['/../AutoloaderTest.php'], + ['/AutoloaderTest.php'], + ['\\AutoloaderTest.php'], + ['//AutoloaderTest.php'], + ['\\\\AutoloaderTest.php'], + ['/./AutoloaderTest.php'], + ['\\.\\AutoloaderTest.php'], + ['C:/AutoloaderTest.php'], + ['C:\\AutoloaderTest.php'], ]; }