Fix AssignNameExpression to forbid using names that won't work

This commit is contained in:
Fabien Potencier
2024-10-14 13:36:30 +02:00
parent 3eda65e94f
commit 9af72e6323
8 changed files with 62 additions and 8 deletions
+1 -5
View File
@@ -784,11 +784,7 @@ class ExpressionParser
} else {
$stream->expect(Token::NAME_TYPE, null, 'Only variables can be assigned to');
}
$value = $token->getValue();
if (\in_array(strtolower($value), ['true', 'false', 'none', 'null'])) {
throw new SyntaxError(\sprintf('You cannot assign a value to "%s".', $value), $token->getLine(), $stream->getSourceContext());
}
$targets[] = new AssignNameExpression($value, $token->getLine());
$targets[] = new AssignNameExpression($token->getValue(), $token->getLine());
if (!$stream->nextIf(Token::PUNCTUATION_TYPE, ',')) {
break;
@@ -13,9 +13,20 @@
namespace Twig\Node\Expression;
use Twig\Compiler;
use Twig\Error\SyntaxError;
class AssignNameExpression extends NameExpression
{
public function __construct(string $name, int $lineno)
{
// All names supported by ExpressionParser::parsePrimaryExpression() should be excluded
if (\in_array(strtolower($name), ['true', 'false', 'none', 'null'])) {
throw new SyntaxError(\sprintf('You cannot assign a value to "%s".', $name), $lineno);
}
parent::__construct($name, $lineno);
}
public function compile(Compiler $compiler): void
{
$compiler
+4 -3
View File
@@ -35,9 +35,10 @@ final class FromTokenParser extends AbstractTokenParser
while (true) {
$name = $stream->expect(Token::NAME_TYPE)->getValue();
$alias = $name;
if ($stream->nextIf('as')) {
$alias = $stream->expect(Token::NAME_TYPE)->getValue();
$alias = new AssignNameExpression($stream->expect(Token::NAME_TYPE)->getValue(), $token->getLine());
} else {
$alias = new AssignNameExpression($name, $token->getLine());
}
$targets[$name] = $alias;
@@ -53,7 +54,7 @@ final class FromTokenParser extends AbstractTokenParser
$node = new ImportNode($macro, $var, $token->getLine(), $this->parser->isMainScope());
foreach ($targets as $name => $alias) {
$this->parser->addImportedSymbol('function', $alias, 'macro_'.$name, $var);
$this->parser->addImportedSymbol('function', $alias->getAttribute('name'), 'macro_'.$name, $var);
}
return $node;
@@ -0,0 +1,8 @@
--TEST--
"map" filter
--TEMPLATE--
{{ [1, 2]|map(true => true * 2)|join(', ') }}
--DATA--
return []
--EXCEPTION--
Twig\Error\SyntaxError: You cannot assign a value to "true" in "index.twig" at line 2.
@@ -0,0 +1,9 @@
--TEST--
"for" tag
--TEMPLATE--
{% for true in [1, 2] %}
{% endfor %}
--DATA--
return []
--EXCEPTION--
Twig\Error\SyntaxError: You cannot assign a value to "true" in "index.twig" at line 2.
@@ -0,0 +1,13 @@
--TEST--
"from" tag
--TEMPLATE--
{% from _self import input as true %}
{{ true('username') }}
{% macro input(name) -%}
{% endmacro %}
--DATA--
return []
--EXCEPTION--
Twig\Error\SyntaxError: You cannot assign a value to "true" in "index.twig" at line 2.
@@ -0,0 +1,8 @@
--TEST--
"import" tag
--TEMPLATE--
{% import _self as true %}
--DATA--
return []
--EXCEPTION--
Twig\Error\SyntaxError: You cannot assign a value to "true" in "index.twig" at line 2.
@@ -0,0 +1,8 @@
--TEST--
"set" tag
--TEMPLATE--
{% set true = 'foo' %}
--DATA--
return []
--EXCEPTION--
Twig\Error\SyntaxError: You cannot assign a value to "true" in "index.twig" at line 2.