Add sandbox tests for unallowed parser-callable functions

2026-09-14 03:16:34 +00:00 · 2026-05-25 08:07:03 +02:00
parent 97bd3d9552
commit 401fb157fb
1 changed files with 43 additions and 0 deletions
@@ -118,6 +118,49 @@ class SandboxTest extends TestCase
        yield ['with', '{% with foo %}{% endwith %}'];
    }

+    #[DataProvider('getUnallowedParserCallableFunctionsTests')]
+    public function testSandboxUnallowedParserCallableFunctions(string $function, string $templateName, array $extraTemplates, array $allowedTags, array $context)
+    {
+        $twig = $this->getEnvironment(true, [], $extraTemplates, $allowedTags, [], [], [], []);
+
+        try {
+            $twig->load($templateName)->render($context);
+            $this->fail(\sprintf('Sandbox throws a SecurityError exception when the "%s" function is not in allowedFunctions', $function));
+        } catch (SecurityNotAllowedFunctionError $e) {
+            $this->assertSame($function, $e->getFunctionName());
+        }
+    }
+
+    public static function getUnallowedParserCallableFunctionsTests()
+    {
+        yield 'attribute' => [
+            'attribute',
+            'index',
+            ['index' => '{{ attribute(data, "secret") }}'],
+            [],
+            ['data' => ['secret' => 'LEAK']],
+        ];
+
+        yield 'block' => [
+            'block',
+            'index',
+            ['index' => '{% block content %}B{% endblock %}{{ block("content") }}'],
+            ['block'],
+            [],
+        ];
+
+        yield 'parent' => [
+            'parent',
+            'child',
+            [
+                'base' => '{% block content %}PARENT{% endblock %}',
+                'child' => '{% extends "base" %}{% block content %}{{ parent() }} CHILD{% endblock %}',
+            ],
+            ['block', 'extends'],
+            [],
+        ];
+    }
+
    #[DataProvider('getAllowedParserCallableFunctionsTests')]
    public function testSandboxWithAllowedParserCallableFunctions(string $templateName, array $extraTemplates, array $allowedTags, array $allowedMethods, array $allowedProperties, array $allowedFunctions, array $context, string $expected)
    {