added template line number to sandbox security check calls

This commit is contained in:
Fabien Potencier
2019-04-17 08:53:56 +02:00
parent f37212b022
commit 96e2432d1f
4 changed files with 14 additions and 6 deletions
+2 -2
View File
@@ -1602,7 +1602,7 @@ function twig_get_attribute(Environment $env, Source $source, $object, $item, ar
}
if ($sandboxed) {
$env->getExtension(SandboxExtension::class)->checkPropertyAllowed($object, $item, $source);
$env->getExtension(SandboxExtension::class)->checkPropertyAllowed($object, $item, $lineno, $source);
}
return $object->$item;
@@ -1679,7 +1679,7 @@ function twig_get_attribute(Environment $env, Source $source, $object, $item, ar
}
if ($sandboxed) {
$env->getExtension(SandboxExtension::class)->checkMethodAllowed($object, $method, $source);
$env->getExtension(SandboxExtension::class)->checkMethodAllowed($object, $method, $lineno, $source);
}
// Some objects throw exceptions when they have __call, and the method we try
+6 -3
View File
@@ -77,39 +77,42 @@ final class SandboxExtension extends AbstractExtension
}
}
public function checkMethodAllowed($obj, $method, Source $source = null)
public function checkMethodAllowed($obj, $method, int $lineno = -1, Source $source = null)
{
if ($this->isSandboxed()) {
try {
$this->policy->checkMethodAllowed($obj, $method);
} catch (SecurityNotAllowedMethodError $e) {
$e->setSourceContext($source);
$e->setTemplateLine($lineno);
throw $e;
}
}
}
public function checkPropertyAllowed($obj, $method, Source $source = null)
public function checkPropertyAllowed($obj, $method, int $lineno = -1, Source $source = null)
{
if ($this->isSandboxed()) {
try {
$this->policy->checkPropertyAllowed($obj, $method);
} catch (SecurityNotAllowedPropertyError $e) {
$e->setSourceContext($source);
$e->setTemplateLine($lineno);
throw $e;
}
}
}
public function ensureToStringAllowed($obj, Source $source = null)
public function ensureToStringAllowed($obj, int $lineno = -1, Source $source = null)
{
if ($this->isSandboxed() && \is_object($obj) && method_exists($obj, '__toString')) {
try {
$this->policy->checkMethodAllowed($obj, '__toString');
} catch (SecurityNotAllowedMethodError $e) {
$e->setSourceContext($source);
$e->setTemplateLine($lineno);
throw $e;
}
+4 -1
View File
@@ -33,9 +33,12 @@ class CheckToStringNode extends AbstractExpression
public function compile(Compiler $compiler)
{
$expr = $this->getNode('expr');
$compiler
->raw('$this->sandbox->ensureToStringAllowed(')
->subcompile($this->getNode('expr'))
->subcompile($expr)
->raw(', ')
->repr($expr->getTemplateLine())
->raw(', $this->source)')
;
}
+2
View File
@@ -43,6 +43,8 @@ class SandboxedPrintNode extends PrintNode
$compiler
->write('$this->extensions[SandboxExtension::class]->ensureToStringAllowed(')
->subcompile($expr)
->raw(', ')
->repr($expr->getTemplateLine())
->raw(", \$this->source);\n")
;
}