diff --git a/src/Extension/CoreExtension.php b/src/Extension/CoreExtension.php index fde808946..ce0a9069b 100644 --- a/src/Extension/CoreExtension.php +++ b/src/Extension/CoreExtension.php @@ -1602,7 +1602,7 @@ function twig_get_attribute(Environment $env, Source $source, $object, $item, ar } if ($sandboxed) { - $env->getExtension(SandboxExtension::class)->checkPropertyAllowed($object, $item, $source); + $env->getExtension(SandboxExtension::class)->checkPropertyAllowed($object, $item, $lineno, $source); } return $object->$item; @@ -1679,7 +1679,7 @@ function twig_get_attribute(Environment $env, Source $source, $object, $item, ar } if ($sandboxed) { - $env->getExtension(SandboxExtension::class)->checkMethodAllowed($object, $method, $source); + $env->getExtension(SandboxExtension::class)->checkMethodAllowed($object, $method, $lineno, $source); } // Some objects throw exceptions when they have __call, and the method we try diff --git a/src/Extension/SandboxExtension.php b/src/Extension/SandboxExtension.php index f6267b64d..d16e4edd0 100644 --- a/src/Extension/SandboxExtension.php +++ b/src/Extension/SandboxExtension.php @@ -77,39 +77,42 @@ final class SandboxExtension extends AbstractExtension } } - public function checkMethodAllowed($obj, $method, Source $source = null) + public function checkMethodAllowed($obj, $method, int $lineno = -1, Source $source = null) { if ($this->isSandboxed()) { try { $this->policy->checkMethodAllowed($obj, $method); } catch (SecurityNotAllowedMethodError $e) { $e->setSourceContext($source); + $e->setTemplateLine($lineno); throw $e; } } } - public function checkPropertyAllowed($obj, $method, Source $source = null) + public function checkPropertyAllowed($obj, $method, int $lineno = -1, Source $source = null) { if ($this->isSandboxed()) { try { $this->policy->checkPropertyAllowed($obj, $method); } catch (SecurityNotAllowedPropertyError $e) { $e->setSourceContext($source); + $e->setTemplateLine($lineno); throw $e; } } } - public function ensureToStringAllowed($obj, Source $source = null) + public function ensureToStringAllowed($obj, int $lineno = -1, Source $source = null) { if ($this->isSandboxed() && \is_object($obj) && method_exists($obj, '__toString')) { try { $this->policy->checkMethodAllowed($obj, '__toString'); } catch (SecurityNotAllowedMethodError $e) { $e->setSourceContext($source); + $e->setTemplateLine($lineno); throw $e; } diff --git a/src/Node/CheckToStringNode.php b/src/Node/CheckToStringNode.php index b20fb3d4c..02b42fcdb 100644 --- a/src/Node/CheckToStringNode.php +++ b/src/Node/CheckToStringNode.php @@ -33,9 +33,12 @@ class CheckToStringNode extends AbstractExpression public function compile(Compiler $compiler) { + $expr = $this->getNode('expr'); $compiler ->raw('$this->sandbox->ensureToStringAllowed(') - ->subcompile($this->getNode('expr')) + ->subcompile($expr) + ->raw(', ') + ->repr($expr->getTemplateLine()) ->raw(', $this->source)') ; } diff --git a/src/Node/SandboxedPrintNode.php b/src/Node/SandboxedPrintNode.php index 97df3438a..54e92e66f 100644 --- a/src/Node/SandboxedPrintNode.php +++ b/src/Node/SandboxedPrintNode.php @@ -43,6 +43,8 @@ class SandboxedPrintNode extends PrintNode $compiler ->write('$this->extensions[SandboxExtension::class]->ensureToStringAllowed(') ->subcompile($expr) + ->raw(', ') + ->repr($expr->getTemplateLine()) ->raw(", \$this->source);\n") ; }