From 401fb157fbb4a385dddea4fcd87dc7a292d8833f Mon Sep 17 00:00:00 2001
From: Fabien Potencier <fabien@potencier.org>
Date: Mon, 25 May 2026 08:07:03 +0200
Subject: [PATCH] Add sandbox tests for unallowed parser-callable functions

---
 tests/Extension/SandboxTest.php | 43 +++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/tests/Extension/SandboxTest.php b/tests/Extension/SandboxTest.php
index 91404fc40..71051da25 100644
--- a/tests/Extension/SandboxTest.php
+++ b/tests/Extension/SandboxTest.php
@@ -118,6 +118,49 @@ class SandboxTest extends TestCase
         yield ['with', '{% with foo %}{% endwith %}'];
     }
 
+    #[DataProvider('getUnallowedParserCallableFunctionsTests')]
+    public function testSandboxUnallowedParserCallableFunctions(string $function, string $templateName, array $extraTemplates, array $allowedTags, array $context)
+    {
+        $twig = $this->getEnvironment(true, [], $extraTemplates, $allowedTags, [], [], [], []);
+
+        try {
+            $twig->load($templateName)->render($context);
+            $this->fail(\sprintf('Sandbox throws a SecurityError exception when the "%s" function is not in allowedFunctions', $function));
+        } catch (SecurityNotAllowedFunctionError $e) {
+            $this->assertSame($function, $e->getFunctionName());
+        }
+    }
+
+    public static function getUnallowedParserCallableFunctionsTests()
+    {
+        yield 'attribute' => [
+            'attribute',
+            'index',
+            ['index' => '{{ attribute(data, "secret") }}'],
+            [],
+            ['data' => ['secret' => 'LEAK']],
+        ];
+
+        yield 'block' => [
+            'block',
+            'index',
+            ['index' => '{% block content %}B{% endblock %}{{ block("content") }}'],
+            ['block'],
+            [],
+        ];
+
+        yield 'parent' => [
+            'parent',
+            'child',
+            [
+                'base' => '{% block content %}PARENT{% endblock %}',
+                'child' => '{% extends "base" %}{% block content %}{{ parent() }} CHILD{% endblock %}',
+            ],
+            ['block', 'extends'],
+            [],
+        ];
+    }
+
     #[DataProvider('getAllowedParserCallableFunctionsTests')]
     public function testSandboxWithAllowedParserCallableFunctions(string $templateName, array $extraTemplates, array $allowedTags, array $allowedMethods, array $allowedProperties, array $allowedFunctions, array $context, string $expected)
     {