mirror of
https://github.com/twigphp/Twig.git
synced 2026-08-31 12:37:15 +00:00
added template line number to sandbox security check calls
This commit is contained in:
@@ -1602,7 +1602,7 @@ function twig_get_attribute(Environment $env, Source $source, $object, $item, ar
|
||||
}
|
||||
|
||||
if ($sandboxed) {
|
||||
$env->getExtension(SandboxExtension::class)->checkPropertyAllowed($object, $item, $source);
|
||||
$env->getExtension(SandboxExtension::class)->checkPropertyAllowed($object, $item, $lineno, $source);
|
||||
}
|
||||
|
||||
return $object->$item;
|
||||
@@ -1679,7 +1679,7 @@ function twig_get_attribute(Environment $env, Source $source, $object, $item, ar
|
||||
}
|
||||
|
||||
if ($sandboxed) {
|
||||
$env->getExtension(SandboxExtension::class)->checkMethodAllowed($object, $method, $source);
|
||||
$env->getExtension(SandboxExtension::class)->checkMethodAllowed($object, $method, $lineno, $source);
|
||||
}
|
||||
|
||||
// Some objects throw exceptions when they have __call, and the method we try
|
||||
|
||||
@@ -77,39 +77,42 @@ final class SandboxExtension extends AbstractExtension
|
||||
}
|
||||
}
|
||||
|
||||
public function checkMethodAllowed($obj, $method, Source $source = null)
|
||||
public function checkMethodAllowed($obj, $method, int $lineno = -1, Source $source = null)
|
||||
{
|
||||
if ($this->isSandboxed()) {
|
||||
try {
|
||||
$this->policy->checkMethodAllowed($obj, $method);
|
||||
} catch (SecurityNotAllowedMethodError $e) {
|
||||
$e->setSourceContext($source);
|
||||
$e->setTemplateLine($lineno);
|
||||
|
||||
throw $e;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public function checkPropertyAllowed($obj, $method, Source $source = null)
|
||||
public function checkPropertyAllowed($obj, $method, int $lineno = -1, Source $source = null)
|
||||
{
|
||||
if ($this->isSandboxed()) {
|
||||
try {
|
||||
$this->policy->checkPropertyAllowed($obj, $method);
|
||||
} catch (SecurityNotAllowedPropertyError $e) {
|
||||
$e->setSourceContext($source);
|
||||
$e->setTemplateLine($lineno);
|
||||
|
||||
throw $e;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public function ensureToStringAllowed($obj, Source $source = null)
|
||||
public function ensureToStringAllowed($obj, int $lineno = -1, Source $source = null)
|
||||
{
|
||||
if ($this->isSandboxed() && \is_object($obj) && method_exists($obj, '__toString')) {
|
||||
try {
|
||||
$this->policy->checkMethodAllowed($obj, '__toString');
|
||||
} catch (SecurityNotAllowedMethodError $e) {
|
||||
$e->setSourceContext($source);
|
||||
$e->setTemplateLine($lineno);
|
||||
|
||||
throw $e;
|
||||
}
|
||||
|
||||
@@ -33,9 +33,12 @@ class CheckToStringNode extends AbstractExpression
|
||||
|
||||
public function compile(Compiler $compiler)
|
||||
{
|
||||
$expr = $this->getNode('expr');
|
||||
$compiler
|
||||
->raw('$this->sandbox->ensureToStringAllowed(')
|
||||
->subcompile($this->getNode('expr'))
|
||||
->subcompile($expr)
|
||||
->raw(', ')
|
||||
->repr($expr->getTemplateLine())
|
||||
->raw(', $this->source)')
|
||||
;
|
||||
}
|
||||
|
||||
@@ -43,6 +43,8 @@ class SandboxedPrintNode extends PrintNode
|
||||
$compiler
|
||||
->write('$this->extensions[SandboxExtension::class]->ensureToStringAllowed(')
|
||||
->subcompile($expr)
|
||||
->raw(', ')
|
||||
->repr($expr->getTemplateLine())
|
||||
->raw(", \$this->source);\n")
|
||||
;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user